OP 29 December, 2021 - 09:19 AM
https://thehackernews.com/2021/12/extrem...ility.html
"The Apache Software Foundation has released fixes to contain an actively exploited zero-day vulnerability affecting the widely-used Apache Log4j Java-based logging library that could be weaponized to execute malicious code and allow a complete takeover of vulnerable systems.
Tracked as CVE-2021-44228 and by the monikers Log4Shell or LogJam, the issue concerns a case of unauthenticated, remote code execution (RCE) on any application that uses the open-source utility and affects versions Log4j 2.0-beta9 up to 2.14.1. The bug has scored a perfect 10 on 10 in the CVSS rating system, indicative of the severity of the issue.
"An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled," the Apache Foundation said in an advisory. "From Log4j 2.15.0, this behavior has been disabled by default.""
For those interested in how to exploit it:
Medium article:
https://medium.com/geekculture/log4shell...2352612ca6
John Hammond video on hacking Minecraft servers
[Video: https://www.youtube.com/watch?v=7qoPDq41xhQ]
PentesterLab (paid):
https://pentesterlab.com/exercises/log4j_rce/course
"The Apache Software Foundation has released fixes to contain an actively exploited zero-day vulnerability affecting the widely-used Apache Log4j Java-based logging library that could be weaponized to execute malicious code and allow a complete takeover of vulnerable systems.
Tracked as CVE-2021-44228 and by the monikers Log4Shell or LogJam, the issue concerns a case of unauthenticated, remote code execution (RCE) on any application that uses the open-source utility and affects versions Log4j 2.0-beta9 up to 2.14.1. The bug has scored a perfect 10 on 10 in the CVSS rating system, indicative of the severity of the issue.
"An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled," the Apache Foundation said in an advisory. "From Log4j 2.15.0, this behavior has been disabled by default.""
For those interested in how to exploit it:
Medium article:
https://medium.com/geekculture/log4shell...2352612ca6
John Hammond video on hacking Minecraft servers
[Video: https://www.youtube.com/watch?v=7qoPDq41xhQ]
PentesterLab (paid):
https://pentesterlab.com/exercises/log4j_rce/course