4 ms·

But the issue was also fixed in all recent versions of JVM's. So it is only an issue on "old" versions - right?

• xendo 5y ago
  That's incorrect, while LDAP portion of this problem is mitigated im new JDKs there are other vectors of attack like RMI. It's by far the easiest and most severe vulnerability I've ever seen.
  • barbarbar 5y ago
    Do you have a source for that?
    • xendo 5y ago
      https://www.veracode.com/blog/research/exploiting-jndi-injections-java https://www.veracode.com/blog/research/exploiting-jndi-injec...
      • barbarbar 5y ago
        As they mention these are custom examples where you make lookup on user supplied string. But do you have an example of that? It seems highly unlikely to do jndi lookups based on user input.
        • xendo 5y ago
          ${jndi:rmi://localhost:1099/ObjectName} will do the lookup to the lookup to the RMI server for ObjectName.