3 ms·
This was by design. Java has a history of these kinds of wild exploits ever since the XML days. The original use case was probably something like: we want to b
by pja 5y ago
This was by design. Java has a history of these kinds of wild exploits ever since the XML days.
The original use case was probably something like: we want to be able to customise the logging on a per user/customer basis, so if we can make a call to our LDAP server, we can return a Java class that will implement that customisation.
This is enterprise level thinking.
Some history from cloudflare here: https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/ https://blog.cloudflare.com/inside-the-log4j2-vulnerability-...
- ljm 5y agoThis is definitely the kind of thing you'd get from an enterprise IT consultancy when you ask for an ERP system and require services to authenticate via ActiveDirectory.
- xvector 5y agoNever go full enterprise level thinking.
- sildur 5y ago> This is enterprise level thinking. An enterprise-level app must be like a slum built on a minefield, then.
- dtgriscom 5y agoMore like a disco dance floor built on a minefield.