3 ms·
Does anyone in here know what url schemes are valid for JNDI and/or this bug in particular? The example is LDAP but is that the only one JNDI supports? Would
by jcims 5y ago
Does anyone in here know what url schemes are valid for JNDI and/or this bug in particular? The example is LDAP but is that the only one JNDI supports? Would HTTPS or even data urls work?
- adambatkin 5y agoOut of the box (at least on my text 1.8 JVM): corbaname, dns, iiop, iiopname, ldap, ldaps, rmi For full details of how this works, use a vulnerable log4j version, log a simple (bad) lookup, and step through with a debugger for a while. Sources: - https://github.com/JetBrains/jdk8u_jdk/blob/master/src/share/classes/com/sun/naming/internal/ResourceManager.java#L422 - https://github.com/JetBrains/jdk8u_jdk/blob/master/src/share/classes/javax/naming/spi/NamingManager.java#L558 - https://github.com/JetBrains/jdk8u_jdk/tree/master/src/share/classes/com/sun/jndi/url By default the class will be named "com.sun.jndi.url.<scheme>.<scheme>URLContextFactory" So for example, if your schema, the class will be "com.sun.jndi.url.ldap.ldapURLContextFactory". But also note that many of these schemes can return referrals/redirects to other protocols.
- immibis 5y agohttps://docs.oracle.com/javase/tutorial/jndi/overview/index.html https://docs.oracle.com/javase/tutorial/jndi/overview/index.... says that LDAP, DNS, RMI Registry, and CORBA Name Service are included in Java, and others may be discovered at load time (but I bet they aren't because that's very niche).
- jcims 5y agoThank you!!! I have absolutely no idea why i couldn’t find that reference. This is extremely helpful. DNS could be gnarly if serialized objects can be stored in txt records.