3 ms·

Do you have any java in your application stack (i.e. elastic search)? If there’s no java, then there’s no log4j and you may worry about other issues.

• bushbaba 5y ago
  *are you using ElasticSearch, flink, spark, prest,…etc. do they read in user data supplied by your front end. Could this user data end up being logged intentionally or part of an error log output. If so, you might be vulnerable and should update those systems.
  • charcircuit 5y ago
    those don't run on the front end
    • Xylakant 5y ago
      It doesn’t matter. An nginx web server logging an odd user agent, elasticsearch picks it up. And then, due to some error triggered by the attacker, the content of the webserver log line gets logged on the ES side (for example if it violates a constraint). Frontend bypassed, attack owns ES. I’ve spent my weekend celebrating that I don’t have Java software in a stack that I’m responsible for right now - and feeling sorry for my ex-colleagues that do. Edit: I haven’t tested or checked whether ES is vulnerable or not - but given the severity of this issue I’d default to the pessimistic stance of assuming it is, until proven otherwise.
      • wiredfool 5y ago
        I'm seeing on 7.15, logstash and elasticsearch both ship log4j in the vulnerable range, but in my case, I'm running a new enough java that it shouldn't be an issue.
        • cesarb 5y ago
          As has been commented several times on other threads here on HN, a new enough Java only protects against one kind of exploit (directly loading arbitrary bytecode) but not others (serialization tricks to execute arbitrary function calls, or data exfiltration).
      • charcircuit 5y ago
        It does matter. To quote the original parent: "do I need to worry about this as a frontend web developer?" A frontend web developer doesn't manage nginx, nor ES. The backend should be patched. It is not safe to just mitigate the bug by using code in the frontend.
        • xwolfi 5y ago
          As a frontend dev shouldn't you worry about your clients, rather than the boundaries of your organisation ? Harass whomever is putting the log4j dependency in the backend until they patch, don't expect them to know by default.
          • charcircuit 5y ago
            Sure, but it's not your job to know every single vulnerability that can be in your backend.