Top all-time · #12740
Pure randomness
Personal blog · mbechler.github.iosecurityprogramming
Pure randomness is a personal blog at mbechler.github.io about security and programming. Since 2018, 6 different Hacker News readers have linked it 8 times. The last post was in 2021, but the archive is still widely read.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
Linked in Log4Shell threads as a PSA on JNDI injection, arguing that JDK patches don't fully stop RCE, such as in some Tomcat and WebSphere setups. Commenters cite it as support for their points.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Random ramblings, exploits and projects.
Most-linked posts?
- /2021/12/10/PSA_Log4Shell_JNDI_Injection/5 people · 7 mentions · first linked 2021-12-10
What Hacker News says?
Or maybe not: > Apparently there had been a prior patch (CVE-2009-1094) for LDAP, but that was completely ineffective for the factory codebase. Therefore, LDAP names would still allow direct remote code execution for some time after the RMI patch. That “oversight” was only addressed later as CVE-2018-3149 in Java 8u191 (see https://bugzilla.redhat.com/show_bug.cgi?id=1639834 ). https://mbechler.github.io/2021/12/10/…
Comment linking /2021/12/10/PSA_Log4Shell_JNDI_Injection/
on “Log4j RCE Found”Submitted Java: Exploiting your “unreachable” JRMP/RMI/JMX endpoints [CVE-2018-2800] as a story · 2 points
HN discussionAha! It's more complicated than i thought: https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Inj...
Comment linking /2021/12/10/PSA_Log4Shell_JNDI_Injection/
on “Log4j RCE Found”It’s not the licensing, it’s the amount of incompatibilities JDK 9 introduced. Also, current JDK versions are still vulnerable: https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Inj...
Comment linking /2021/12/10/PSA_Log4Shell_JNDI_Injection/
on “Log4j: Between a rock and a hard place”Simply using a modern JDK does not fully resolve the issue. See here: https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Inj...
Comment linking /2021/12/10/PSA_Log4Shell_JNDI_Injection/
on “Log4j: Between a rock and a hard place”Not a Java programmer, I still don't really understand how the ability to inject a JNDI lookup to your sever results in an RCE. OK, an attacker can inject a JNDI lookup, and can control what the JNDI lookup via LDAP returns... I would have thought that whatever it returned would just get inserted as a string into the log output, no big deal. But a remote JNDI lookup can return code that gets executed on the local si…
Comment linking /2021/12/10/PSA_Log4Shell_JNDI_Injection/
on “Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide”It’s still an issue with current JDKs in certain environments (e.g. Tomcat), see https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Inj... and https://www.veracode.com/blog/research/exploiting-jndi-injec... . Also, 8u121 was an incomplete fix, the complete fix (still with limitations as noted above) is in 8u191 (see second link above).
Comment linking /2021/12/10/PSA_Log4Shell_JNDI_Injection/
on “Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide”This post claims the history of which releases closed which holes is a bit more complicated and that 8u191 really is the first release to prevent this particular exploit. However it also points out that it’s still possible to achieve RCE via log4j template expansion in certain Tomcat and Websphere configurations: https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Inj...
Comment linking /2021/12/10/PSA_Log4Shell_JNDI_Injection/
on “Widespread exploitation of critical remote code execution in Apache Log4j”
