3 ms·
Shortest version: log4j has a helpful "feature" where if you log a specifically formatted string as a value, it can trigger things like DNS lookup or remote cod
by jffry 5y ago
Shortest version: log4j has a helpful "feature" where if you log a specifically formatted string as a value, it can trigger things like DNS lookup or remote code execution.
If you use a vulnerable log4j version to log any user-controlled value (such as a User-Agent header), it's a bad time.
Evidently Minecraft used log4j to log user chat messages, allowing a player on a server to leak other players IP addresses.
- CuriousCosmic 5y agoSo far people have been showing off RCE "hello world" for both minecraft clients and servers on twitter. In terms of actual threat this exploit could be easily abused to rapidly spread ransomware, cryptominer malware, botnet slave code, and other nasties extremely easily. You could (devs on twitter have been playing with this) build a script that connects to random servers listed on Shodan and send a message with a payload in it. This payload then executes on both the clients and the server infecting them. Then those clients can have their credentials and server lists used to infect other servers and clients. Considering how many Minecraft servers are just thrown up on old windows machines by people with little to no IT knowledge, I can see this getting out of hand very quickly.