Log4j RCE Found (lunasec.io)

Article summary

The article discusses a remote code execution (RCE) vulnerability in Log4j, a popular Java logging library. The vulnerability can be exploited by logging a user-controlled string that uses the JNDI URL schema. A mitigation is to set log4j.formatMsgNoLookups=true or update to version 2.15.0-rc1. The vulnerability has been patched, but concerns remain about potential alternative exploitation methods.

Main themes

• Log4j vulnerability
• RCE exploitation
• Mitigation and patching
• Java version compatibility
• Backwards compatibility
• Code security and analysis

What commenters say

• The Log4j vulnerability can be mitigated by setting a specific system property or updating to a newer version.
• The vulnerability is still exploitable in certain scenarios, even with the latest Java versions.
• Disabling JNDI lookups or parsing altogether would be a more effective mitigation than the current fix.
• The fix for the vulnerability adds a significant amount of new code, which may not be the best solution.
• Backwards compatibility is a major concern for the Log4j library, making it difficult to remove features or make significant changes.
• The vulnerability has been exploited in the wild, including in Minecraft servers.
• Static code analyzers should be able to detect and flag vulnerable Log4j dependencies.
• The severity of the vulnerability is reduced in modern Java versions, but pingback attacks are still possible.