3 ms·
In this case the library is using JNDI to go get a class from an LDAP server to execute.
by cplusplusfellow 5y ago
In this case the library is using JNDI to go get a class from an LDAP server to execute.
- abhishekjha 5y agoBut where does it get used? I mean the loading of a remote class on an LDAP server. Was this an opt-in or is it like properly baked in?
- cplusplusfellow 5y agoYou would call out to JNDI in a logging statement. That would cause the remote class to be loaded and executed during the log statement evaluation. A nefarious attacker could inject such a JNDI reference in a field (like username or whatever) and if you wrote your log statements in a manner that didn’t expect such injection to happen, it could become part of the log format instead of a log field value, and this would be executed. Think of it like SQL injection but with log statements and way worse because it calls a class that can be hosted on a server of choice. And the code that can execute is arbitrary and not limited to the database.