logging-log4j2

Apparently someone made an oopsi and posted the vuln as issue https://github.com/apache/logging-log4j2/issues/4255

It's Strings. They go somewhere. The interface writes itself: Consumer<String>. At my absolute fanciest, I use a Queue, some terminal colouring, separate stderr from stdout, and write some short-hand functions (warn, err, info, etc.). These are the bugs I don't have: https://github.com/apache/logging-log4j2/issues

I don't think that's a good example. While Apache devs are volunteers and Microsoft devs are employees, they were nevertheless criticized for their slow response time and perceived lack of urgency until it was far too late. https://github.com/apache/logging-log4j2/pull/608#issuecomme...

It started here https://github.com/apache/logging-log4j2/pull/608#issuecomme... and was rapidly recognized that this impacted almost everything. Minecraft servers were one of the most accessible places to use the exploit and at the same time, some of the ones that are least likely to patch updates rapidly.

> When it was first revealed in early December 2021, the Log4Shell bug was described as one of the most severe security vulnerabilities ever. > The Apache Software Foundation, which maintains the open-source tool, quickly released a patch... Apache horribly mismanaged this and did not release a patch until it was already widely known and being exploited in the wild. They also messed up and had to release several subsequent patches to actually fix the vulnerability. This greatly contributed to "[the] mad scramble to plug the gaps". You can watch the chaos unfold by reading through the GitHub PR. Remember, this was disclosed to Apache in November. https://github.com/apache/logging-log4j2/pull/608#issuecomme...

Ha! Well, there's a lot. On major strand is more work like this to make it easy for the community to collaborate. I expect we'll make a lot of iterative improvements to the database over the next few months, aimed at making it easier to contribute to, maintain and use. We need to improve our APIs for this data, for example (currently only available via GraphQL). Another big one that we're starting to think about is the security vulnerability disclosure process. Our goal there is to support maintainers as much as possible, and there's more we can do. Recent articles on loguru, beg bounties, and the way log4j initially reached public attention all point to problems GitHub can and should help with. In the next 12 months we'd like to give maintainers the option to receive vulnerability disclosures privately on GitHub, and for us to be able to

We couldn't figure out the actual network bypass for this one, so it's not included in the post (even though it's in the CVE). It's gotta be in this function[0] though, and if you have any notes we'd appreciate if you shared any notes with us! Edit: I spoke too soon! As we were writing this, somebody on Twitter figured it out[2]. Also, we just released v1.4 of the Log4Shell CLI tool for detecting + patching this vuln. Feel free to check that out on GitHub[1]. It's got a ton of improvements from the last release. 0: https://github.com/apache/logging-log4j2/blob/master/log4j-c... 1: https://github.com/lunasec-io/lunasec/releases/ 2: https://twitter.com/marcioalm/status/1471740771581652995

> I can still just inject stuff like "${env:DATABASE_PASSWORD:-xxx} In 2.16.0 message lookups have been completely removed: https://github.com/apache/logging-log4j2/pull/623 Lookups now only work in configured patterns. Thats IMHO the way it should have been in the first place.

Insightful conversations at https://github.com/apache/logging-log4j2/pull/608 - the original vulnerability patch. Most JNDI lookups are disabled, except for JAVA and _LDAP(S)_. What I don't get is why would someone who knows about the vulnerability would _still_ want to do LDAP lookups during logging, even when restricted to localhost.

Further details on the most relevant part here: https://github.com/apache/logging-log4j2/pull/608#issuecomme... Applications using log4j pattern layouts including `${ctx:...}` lookups with versions < 2.15 will remain vulnerable to RCE/DNS infoleaks regardless of the `-Dlog4j2.formatMsgNoLookups=true` mitigation, if the attacker can control any of the `org.apache.logging.log4j.ThreadContext` values used in the configured context lookups. Do not rely on the `-Dlog4j2.formatMsgNoLookups=true` mitigation unless you are certain that the application is not using any attacker-controlled context lookups in the log4j pattern layouts. The `zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class` mitigation remains effective for < 2.15.0, and may be a good idea for 2.15.0 as well, to avoid the localhost LDAP connections.