4 ms·
This is actually worse than log4j. Any code accessing JNDI using URIs from external data is vulnerable. Script injection (aka XSS) at its finest. Looks like a
by mkleczek 5y ago
This is actually worse than log4j. Any code accessing JNDI using URIs from external data is vulnerable. Script injection (aka XSS) at its finest.
Looks like a good use case for running under SecurityManager with a restrictive policy.
Maybe it is time to reconsider JEP 411?
- immibis 5y agoHow many code accesses JNDI using URIs for external data? Debug tools, presumably. Monitoring tools.
- mkleczek 5y agoAny JEE code that uses container provided resources. So a lot...
- vips7L 5y agoIn practice I’ve never met anyone who actually uses The Security Manager. So it might have been able to stop this with the proper configuration but I doubt anyone would have configured it to do so.
- mkleczek 5y agoAnd this is the root problem as that's equivalent to running software as root.