The stories and information posted here are artistic works of fiction and falsehood. Only a fool would take anything posted here as fact.
Five Years of Service
Posts: 539
Threads: 10
Log4Shell: Huge log4j vulnerability 12-16-2021, 06:19 PM
#1
I guess you guys have heard of that log4j huge security issue
CVE-2021-44228 (also called Log4Shell)
I know Minecraft servers are concerned, do you know some other popular (self hosted) services that might be targeted?
Also I'd be curious to see an exploit example
(This post was last modified: 12-17-2021, 05:49 PM by fritz.)
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
•
Five Years of Service
Posts: 539
Threads: 10
RE: Log4Shell: Huge log4j vulnerability 12-17-2021, 04:41 PM
#2
Ok I got part of my answer, here is an impressive list of related softwares (some are obviously missing):
https://github.com/NCSC-NL/log4shell/blo.../README.md
I noticed some versions of Elasticsearch, Logstash and SOLR are vulnarable, that could be a big deal
And here is an exploit example:
https://www.exploit-db.com/exploits/50592
EDIT : And here are some nice PoC, included Ghidra and Minecraft:
https://github.com/kozmer/log4j-shell-poc
(sorry about that monologue haha)
(This post was last modified: 12-17-2021, 05:46 PM by fritz.)
•
