Does anyone in here know what url schemes are valid for JNDI and/or this bug in particular? The example is LDAP but is that the only one JNDI supports? Would HTTPS or even data urls work?
For full details of how this works, use a vulnerable log4j version, log a simple (bad) lookup, and step through with a debugger for a while.
Sources:
- https://github.com/JetBrains/jdk8u_jdk/blob/master/src/share/classes/com/sun/naming/internal/ResourceManager.java#L422
- https://github.com/JetBrains/jdk8u_jdk/blob/master/src/share/classes/javax/naming/spi/NamingManager.java#L558
- https://github.com/JetBrains/jdk8u_jdk/tree/master/src/share/classes/com/sun/jndi/url
So for example, if your schema, the class will be "com.sun.jndi.url.ldap.ldapURLContextFactory".
But also note that many of these schemes can return referrals/redirects to other protocols.
says that LDAP, DNS, RMI Registry, and CORBA Name Service are included in Java, and others may be discovered at load time (but I bet they aren't because that's very niche).
DNS could be gnarly if serialized objects can be stored in txt records.