Happy Friday December 10th of 2021 and less happy Friday for anyone dealing with the vulnerability that was recently disclosed on Well, just December 9th of 2021 in the Java log4j library This is a pretty widespread application affecting companies ranging from Tesla to Twitter to Minecraft and yes There's apparently is actively exploitable in Minecraft So there's a lot of servers being pushed out and updated right now And I'll be covering from the blog post here over at Huntress and along with a Reddit post and of course some details that I want to cover Including the fact that this has a base CVSS score of 10 yes 10 the worst you can get Let's start with though a big thanks to Kevin Beaumont who's been discussing this if you're not familiar or follow Kevin Beaumont aka Gossy the dog does some really great in solid security research definitely worth following on Twitter and I Like to thank him for this wonderful logo because I think every exploit needs a logo And I actually like this one because it's a trivially exploit with a trivially John logo in MS paint So that made me smile because nothing else about this vulnerability makes me smile with one more minor exception the Minecraft John Hammond targeting Minecraft because why not if you're gonna do a proof of concept on something Why not start with a game? Obviously this is very serious, but let's talk about just how trivial this is There's a lot of places affected by this what should you do now? This is where we'll start if your organization uses the log4j library upgrade to and they've got the new version right here log4j 2.150 RC2 But I want to talk about where your risk factor is and kind of how this actually works Because the how it works part is mind-blowingly simple and the attacker vector is extremely triple for threat actors a single string of Text can trigger an application to reach out to an external location if it is log V the Thermal instance of log4j So if you have a web server a unify controller or mail server any different Service that runs that maybe you want logging and when you think about how it logs is going to take this log information and you know You write it to var log in the Linux world that's pretty common and the facilities that write it They're just kind of boring they're gonna take the log data and drop it there and boring is okay But sometimes you want to look at it in a little bit more depth and maybe take some action on it And that's where log4j comes in so you actually take in your logs prior to Doing them just settling them somewhere for archival reasons you'll actually parse them with log4j That's where the problem comes in and this is what makes this such an easy vulnerability to exploit I've already seen these exploits coming against my own servers But just because you see the exploit being targeted to it does not mean it can be exploited because the way it works is Any of these logs being collected the people sending out the requests and the threat actors that have set up beacons and just Pampering away at Apache servers and anything they can find publicly available on the internet and sending and seeing what comes back They send that command and if the back end of your system is using this log4j This is where companies like Tesla Twitter and elastic search and all these different services have this and if they're using it to parse that log data It's is trivial as that command right here they put in this right here and That's it it will then execute at the permission levels at the level that that log4j library has so if you've Rendon application as a high-level permission it now can start executing whatever payload was sent to it So it's not necessarily though that everything that depends on this library is going to be Exploidable, but there's a high probability that things that depend on this library are and essentially this comes down to you know You know wondering how long this has been around will actually start here in 2013 so I wanted to do a little bit of research because I was curious You know is this new is this from some updates something opened up and it was on parse I did find a few references to this and it makes complete sense This was implemented right around 2013 and it was look-up plugin support Basically what these log facility does is if you want to take more action on your log and actually have it trigger different things This is actually very handy We can say hey look up these resources do this information not only look at the log But then take action on it so we can have our server do some type of defined actions and look things up based on the Information we find in a log so that implementation was done But it wasn't done properly because they didn't sanitize the input so the execution part comes because of the way you can Simply use these couple commands as pointed out right here if you add this right here That's it. It will then go. Oh, I think you mean to run this so you're taking kind of an advantage of Unparshed information that was supposed to be Pashed out and sanitize before it went through so it can run the commands and jumping it right to the command So you're injecting a command in a spot that the person who would have wrote the logging tool would have had their command So it's a little bit of a clever hack One well in terms of finding it but really trivial in terms of exploiting it So any type of server that happens to be sending input data through this logging facility Potentially could be exploited there's gonna be all kinds of new ones to how different companies actually do their implementation But obviously it's been it's big enough to have this high of a CVS score and cause a lot of stir in the tech industry right now because it's Obviously very very exploitable I was actually happy to see Unify had a patch out right away There's no known as of the making of this video vulnerabilities in Unify from it But the fact that they're dependent on that library There could be some way even if it's not an obvious way that you could send or get a Unify endpoint To create a log that it would parse and then do that because that becomes a little bit tricky because it's not exactly open to the public It's more like the logging facility of each device could possibly make this melform thing But then could you take over device and use it? This is where a lot of people and other friends I'm mind including Riley Chase over at hostify who's been pushing up patches as well A lot of people are looking to see if there's a deeper vulnerability that can be found within this because I think it's very important to be clear when I say right now There's not unknown but it was long as we know that library's hanging out in different applications That gives you the idea of poking at each thing until there's a way you can get around it and see if it will actually execute code And this is what people have been doing. I've seen people do things like well a little bit confusing But it looks like they could rename even their phone and put in the payload as the name of a phone Intellegely based on a Twitter post I've seen that was a way they were able to see if it would be can out and do a look up So anything that puts you a little bit closer to there because like I said Apple Twitter lots of places are using this particular log library It is immensely popular So this is going to be kind of the ripple effect where even though we see a lot of major companies doing it now We know there's probably a lot of things that later on down the road Someone will be looking things up and find an application that never updated this particular library and then start poking away at it So it's hard to really determine the entire extent Having that library does not always mean exploitable But it certainly means potential for exploit and we'll just kind of have to watch as companies patch this and hopefully they patch it And it's better to patch first before you find out there's a vulnerability Which is what Unified did they updated to the new version of library that parses the data properly But that even seeing companies like VMware and I don't know what version are using but even large companies like that are still using some of these libraries in there So we're gonna probably see a just chain of updates that are going on for a long time on this I'll leave links to everything I talked about leave your thoughts and comments down below if you have a system You need to patch patch it if you're running a unified controller Which I know a lot of my audience do go ahead and update that to the latest version as of today It was released and I'll leave link to that down below as well. All right, thanks and Thank you for making it all the way to the end of this video if you've enjoyed the content Please give us a thumbs up if you would like to see more content from this channel hit the subscribe button and the bell icon If you like to hire a sure project head over to Lawrence systems calm and click the hires button right at the top To help this channel out in other ways There's a join button here for YouTube and a patreon page where your support is greatly appreciated for deals discounts and offers Check out our affiliate links in the description of all our videos including a link to our shirt store Where we have a wide variety of shirts that we sell and designs come out well randomly. So check back frequently And finally our forums forums dot Lawrence systems calm is where you can have a more in-depth discussion about this video and other tech topics covered on this channel Thanks again for watching and look forward to hearing from you