New Log4j2 vulnerability

[oars]

Please update the title to indicate this is a low severity CVE and prevent managers around the world from panicking and summoning their developers and engineers back at work during this shut down period.

To be honest, I panicked reading this title when I opened HN this evening, but reading the CVE entry tells me this isn't anywhere close to as serious as CVE-44228.

You have a responsibility to not just share information on HN, but to share it in an accurate and well thought manner.

[break_the_bank]

I clicked on this wondering if the next few days will be ruined like when the original CVE came out. Glad I read your comment.

[rst]

The threat here is that "an attacker with permission to modify the logging configuration file can construct a malicious configuration". If the attacker can modify server config files, this particular log4j fixup is likely to still leave you with nasty problems.

[jfoutz]

yes that would be true. Unfortunately log4j doesn't get configuration exclusively from config files on the server where it's running. this doesn't look like no access to full RCE like the first few rounds. But this might let an attacker turn a small exploit into a big exploit.

[jfoutz]

I've just started looking, and I'm not an expert.

The key point here is log4j can get configuration a lot of different ways, including a network request. Based on https://logging.apache.org/log4j/2.x/manual/configuration.ht... control over dns would let you rewrite sections of config, and thus run arbitrary code.

So, if you've got some access, this would allow you to escalate that access to a full RCE. I think that's why it's only Medium severity.

[alfiedotwtf]

Holy moly, how was that ever a good idea. Just like routers being able to be configured via the manufacturer's website, config by someone other than you seems like a big red flag

[tailspin2019]

> including a network request

The wording in the CVE description of “an attacker with permission to modify the logging configuration file” really obscures that fact if that’s true.

That wording means something very specific to me (and I would assume many others) - my immediate assumption was that it refers to an actual file on disk on the machine running Log4j.

If it can load config over a network request - I feel like this would have been useful to point out in the description?

Unless this particular issue is just restricted to local file-based config?

Sadly it’s late here so I don’t have time to read up further right now. I’ll reserve that pleasure for tomorrow morning…!

[NicolaiS]

"Log4j2 versions 2.0-beta7 through 2.17.0 are vulnerable to a remote code execution attack if an attacker with permission to modify the logging configuration file can construct a malicious configuration"

[Sebguer]

The worst part of these major vulnerabilities is the endless follow-on stream of knee-jerk 'CVE' that are clearly nothing-burgers, and yet will be described as a 'new Log4j' vulnerability, and cause a bunch of people who don't know better to panic.

[dylan604]

All of this reminds me of when Zoom was getting all of the attention. It's something that's been around for a while that nobody noticed, then somebody did. Everyone freaks out, and then New Vuln comes out weekly because now everyone is looking for it. Log4j hit servers, where Zoom hit people directly at home. Which is worse? Depends on persepective

[mnd999]

CVE doesn’t have much credibility at this point as far as I’m concerned. It can mean anything.

[formerly_proven]

Eh, that sounds like it's not a vulnerability at all. Most app server configuration files allow you to load and run arbitrary code.

[phoronixrly]

Yeah, maybe should be mentioned in the title to save people from PTSD over the holidays...

[frogger8]

Correct! https://twitter.com/nas_bench/status/1475940057924222977?s=2...

[johnisgood]

> Most app server configuration files allow you to load and run arbitrary code

I do not understand this. Configuration files allow you to load and run arbitrary code? Is this actually a thing? What are they using for configuration files?! Tcl?

[jet390]

If you've been impacted by these log4j vulnerabilities, have a look at aegis4j, a Java agent that completely disables platform features you don't use, before an attacker uses them against you (including e.g. JNDI and Java serialization).

https://github.com/gredler/aegis4j/

[bjornsing]

Why do they say it’s a RCE (Remote Code Execution) if it requires changing a configuration file?

[MattPalmer1086]

Changing the config enables the RCE vulnerability.

[frogger8]

https://twitter.com/nas_bench/status/1475940057924222977?s=2...

[richardfey]

A couple CVEs ago I'd already have replaced it with a shim using System.err.println()