4 ms·

I haven't read into the specifics of this issue but doesn't a RCE vulnerability in a Java library really rest on a RCE vulnerability in Java/JRE itself?

• the8472 5y ago
  Not necessarily, java has explicit mechanisms for dynamic code loading (classloaders) and if those are reachable from unsanitized user input then you have what amounts to a very indirect and enterprise-grade eval().
• cplusplusfellow 5y ago
  In this case the library is using JNDI to go get a class from an LDAP server to execute.
  • abhishekjha 5y ago
    But where does it get used? I mean the loading of a remote class on an LDAP server. Was this an opt-in or is it like properly baked in?
    • cplusplusfellow 5y ago
      You would call out to JNDI in a logging statement. That would cause the remote class to be loaded and executed during the log statement evaluation. A nefarious attacker could inject such a JNDI reference in a field (like username or whatever) and if you wrote your log statements in a manner that didn’t expect such injection to happen, it could become part of the log format instead of a log field value, and this would be executed. Think of it like SQL injection but with log statements and way worse because it calls a class that can be hosted on a server of choice. And the code that can execute is arbitrary and not limited to the database.