12 ms·
Loading and running a java class is only the most absurd exploitation possibility with log4j. Without that, you can still slurp any environment variables (or ot
by ploxiln 5y ago
Loading and running a java class is only the most absurd exploitation possibility with log4j. Without that, you can still slurp any environment variables (or other process information) and send it to any host. And you can probably do yet other stuff too, it is quite flexible ...
- staticassertion 5y ago> Loading and running a java class is only the most absurd exploitation possibility with log4j. Uh, yeah, the RCE was very bad. And not a thing with Rust due to not having object serialization. > you can still slurp any environment variables (or other process information) and send it to any host Yeah, you can write a logger in rust that does really crazy things like adding environment variables through some sort of parsing of a language construct. That would still be a problem, but a lot less serious. It would probably also be really unidiomatic, but that's a separate story.