+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: Log4Shell: Huge log4j vulnerability (/Thread-Log4Shell-Huge-log4j-vulnerability)
Log4Shell: Huge log4j vulnerability - fritz - 12-16-2021
I guess you guys have heard of that log4j huge security issue CVE-2021-44228 (also called Log4Shell)
I know Minecraft servers are concerned, do you know some other popular (self hosted) services that might be targeted?
Also I'd be curious to see an exploit example
RE: Log4Shell: Huge log4j vulnerability - fritz - 12-17-2021
Ok I got part of my answer, here is an impressive list of related softwares (some are obviously missing): https://github.com/NCSC-NL/log4shell/blob/main/software/README.md
I noticed some versions of Elasticsearch, Logstash and SOLR are vulnarable, that could be a big deal
And here is an exploit example: https://www.exploit-db.com/exploits/50592
EDIT : And here are some nice PoC, included Ghidra and Minecraft: https://github.com/kozmer/log4j-shell-poc
(sorry about that monologue haha)