Hacker News Reader

Comment by brabel | Hacker News Reader

> But one thing that I haven't seen mentioned enough is that this only affects pretty old versions of java.

Please stop repeating this. The only attack that won't work on newer JVM versions is the one based on the LDAP server returning an ObjectFactory that redirects to a class file based on another remote HTTP server. However, that's absolutely not the only attack vector. LDAP itself has other attacks that are possible, and there are other JNDI integrations that also have different attacks, amongst other things, related to Java serialization (and once you can de-serialize bytes on someone's JVM, you have a smorgasbord of attack vectors to play with).

If your log4j version is resolving JNDI strings, you are NOT SAFE regardless of which JVM version you're using.

View on HN

I wish your comment would get higher visibility.

To clarify, the vulnerability would make it possible to post server environment variables to any remote server, regardless of JRE version. That could easily end up being as catastrophic as an RCE.

Yeah that's a disaster, many applications/pods/docker containers store secrets in the environment. Even if it doesn't expose the service from the outside due to firewalls etc, its a(nother) way in for malicious internal users (which I believe are a large portion of, or the majority of, breaches).

Indeed. Anything which exposes a program’s environment to other non-root programs which are not sub-processes should be considered a security bug.

> the vulnerability would make it possible to post server environment variables to any remote server, regardless of JRE version.

I've been able to achieve RCE as well by still using LDAP, but a different lookup mechanism (if you learn about LDAP, you'll quickly realize there's several ways to do this). RCE does not require remote class loading, that's just the easiest way to achieve it.

If your JVM triggered the evaluation of any unsafe jndi string, you should assume an RCE is very likely possible on your environment.

Thanks. I can't edit my comment but I upvoted yours.

Hmm, why you can't edit your comment? There is an edit button in hackernews.

The button is available only for a time window (2h?) after the submission.

Which makes sense, on a message board (which HN is) the feature is mostly supposed to allow quick fixes over minor errors, not retroactive editorial work.

Reply on news.ycombinator.com