4 ms·

I'm curious about the disclosure of this vulnerability and why it seems that no prior notice appears to have been given by the researcher who published it. Is i

by ridaj 5y ago

I'm curious about the disclosure of this vulnerability and why it seems that no prior notice appears to have been given by the researcher who published it. Is it because it was already being exploited in the wild?

alvarlagerlof 5y ago
Me too
pageandrew 5y ago
> The vulnerability was privately disclosed to Apache by Alibaba's Cloud Security Team on 24 November 2021 and publicly disclosed on 9 December 2021. https://en.wikipedia.org/wiki/Log4Shell https://en.wikipedia.org/wiki/Log4Shell
- modoc 5y ago
  It was being exploited in the wild at least as early as Dec 1st (based on log analysis I've seen). The rate of attempted exploits went WAY up after the 9th.
- ineedasername 5y ago
  That still seems like an extremely small window of time to remain on the good side of "responsible disclosure" for a vulnerability of this magnitude. The fix was only released 3 days before public disclosure.
  - flatiron 5y ago
    From what I read the patch is public and when someone saw it figured it out and publicly shared it.
  - staticassertion 5y ago
    Embargoing is very tricky and often harmful. Attackers know how to catch embargo'd vulns, it's often really easy, like in the case of the Linux kernel. If attackers have advanced notice you're only hurting defenders by hiding things from them. We know that two weeks before disclosure there are attacks using this exploit. Somehow had clearly figured it out, so hiding it was only going to cause problems.
rot25 5y ago
Vulnerability researcher here. This vulnerability was patch-gapped before it was disclosed. When the patch went out 9 days ago [1], many vulnerability researchers were able to look at it and identify the root cause within minutes. Exploits started going out over a week ago before it was publicly disclosed and the CVE was released. Good security orgs that can hire skilled vulnerability researchers started patching on December 6th/7th/8th. All the chaos started on December 9th when people started leaking the poc on twitter. The same thing happens to google chrome when they release a patch for a security vulnerability. Very skilled researchers can produce a POC and exploit given the patch alone [2] [1] https://github.com/apache/logging-log4j2/commit/d82b47c https://github.com/apache/logging-log4j2/commit/d82b47c [2] https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome/ https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome...
- ridaj 5y ago
  Thanks, that explains things. I guess I was confused by it being called here and there a "zero-day" - if it's the patch that triggered exploitation, then at least it was already fixed at head by the time it got exploited.
  - deleted 5y ago
    [deleted]

by ridaj 5y ago

alvarlagerlof 5y ago

Me too

pageandrew 5y ago

> The vulnerability was privately disclosed to Apache by Alibaba's Cloud Security Team on 24 November 2021 and publicly disclosed on 9 December 2021. https://en.wikipedia.org/wiki/Log4Shell https://en.wikipedia.org/wiki/Log4Shell

modoc 5y ago
It was being exploited in the wild at least as early as Dec 1st (based on log analysis I've seen). The rate of attempted exploits went WAY up after the 9th.
ineedasername 5y ago
That still seems like an extremely small window of time to remain on the good side of "responsible disclosure" for a vulnerability of this magnitude. The fix was only released 3 days before public disclosure.
- flatiron 5y ago
  From what I read the patch is public and when someone saw it figured it out and publicly shared it.
- staticassertion 5y ago
  Embargoing is very tricky and often harmful. Attackers know how to catch embargo'd vulns, it's often really easy, like in the case of the Linux kernel. If attackers have advanced notice you're only hurting defenders by hiding things from them. We know that two weeks before disclosure there are attacks using this exploit. Somehow had clearly figured it out, so hiding it was only going to cause problems.

rot25 5y ago

Vulnerability researcher here. This vulnerability was patch-gapped before it was disclosed. When the patch went out 9 days ago [1], many vulnerability researchers were able to look at it and identify the root cause within minutes. Exploits started going out over a week ago before it was publicly disclosed and the CVE was released. Good security orgs that can hire skilled vulnerability researchers started patching on December 6th/7th/8th. All the chaos started on December 9th when people started leaking the poc on twitter. The same thing happens to google chrome when they release a patch for a security vulnerability. Very skilled researchers can produce a POC and exploit given the patch alone [2] [1] https://github.com/apache/logging-log4j2/commit/d82b47c https://github.com/apache/logging-log4j2/commit/d82b47c [2] https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome/ https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome...

ridaj 5y ago
Thanks, that explains things. I guess I was confused by it being called here and there a "zero-day" - if it's the patch that triggered exploitation, then at least it was already fixed at head by the time it got exploited.
- deleted 5y ago
  [deleted]