4 ms·
The threat here is that "an attacker with permission to modify the logging configuration file can construct a malicious configuration". If the attacker can mod
by rst 5y ago
The threat here is that "an attacker with permission to modify the logging configuration file can construct a malicious configuration". If the attacker can modify server config files, this particular log4j fixup is likely to still leave you with nasty problems.
- jfoutz 5y agoyes that would be true. Unfortunately log4j doesn't get configuration exclusively from config files on the server where it's running. this doesn't look like no access to full RCE like the first few rounds. But this might let an attacker turn a small exploit into a big exploit.
- btown 5y agoI suppose that there could be companies that load logging configs from a shared filesystem share that the non-security-minded now-retired ex-IT director threw up on an insecure server somewhere "so I can debug the outages better." Still not as bad as the log content being an attack vector!