4 ms·
The newer WebSocket based Log4j attack vector [0] is pretty scary. Maybe not relevant to you/here, but definitely opens up a much bigger attack Surface. [0]htt
by yodon 5y ago
The newer WebSocket based Log4j attack vector [0] is pretty scary. Maybe not relevant to you/here, but definitely opens up a much bigger attack Surface.
[0]https://m.slashdot.org/story/394029 https://m.slashdot.org/story/394029
- jeroenhd 5y agoI think it's only a problem if there's a device accepting websocket connections running on your network. I can't think of anything you would run inside the confines of a presumed safe network that would also accept websockets from arbitrary origins. Attackers would need to brute force or guess the right IP and port combination to do anything with this attack, so I don't think it will be a huge problem in practice. Just something to be aware of.