Hello, welcome to the Monday, December 13, 2021 edition of the Sands and its Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Well, Friday, I guess I was lucky in the sense that I was able to get a log for J or log for Shell, as it's now called, into the podcast.

It's certainly kept us busy on Friday and over the weekend.

Monday at noon Eastern time will have a special live stream with Boyan and Mick in order to discuss some of the issues around

a log for Shell. So you have some time join in. And let me here just summarize a little bit

some of the things that we learned this weekend. So the vulnerability here is in the Log for J2 library and the issue is that this library

is used well for logging as the name implies, but it has the ability to actually sort of

expand certain JNDI strings that are being included in the logs, and this can lead to remote code execution.

It's triggered essentially by tricking log for J into logging specific string.

So in order to make an exploit work, you have to find some software that uses this library,

and then you have to find a way to feed a string to that software that is being logged via Log 4J.

And this process makes a little bit tricky to figure out which software exactly is vulnerable, which one is not vulnerable.

So Log 4J being included and used by the software is your first pointer that it's possibly vulnerable, but some software, for example, Elasticsearch,

has a special Java security manager included that limits what libraries like Log 4J are able to do.

So in this case, you are not vulnerable.

And for other software, like for example, the Embarrs V-Center, you are vulnerable,

but you have to find the right kind of way to expose V-Center to the exploit string, so it's actually

being logged by log 4J.

So a simple exploit as you have, so to see them around, may not work in this case.

The standard test that a lot of people are using is where they're using this JNDI string and then they're using

an LDAP command and a host name, and then they're looking for DNS lookups for the host name.

There have been some false positives here.

...