幹壞事是進步最大的原動力
在 Hacker News 首頁上看到 Google 提供了一套用 Golang 寫的工具，可以掃描 JAR 檔裡面是否有中獎的 Log4j：「log4jscanner」，對應的討論在「Log4jscanner (github.com/google)」這邊。
看起來是內部工具，放出來前先把 vcs history 清掉了：
We unfortunately had to squash the history when open sourcing. The following contributors were instrumental in this project's development: [...]
另外討論裡也有人提到「OWASP Dependency-Check」這個工具也可以掃，這套就更一般性了：
Dependency-check automatically updates itself using the NVD Data Feeds hosted by NIST.
最近大家都在忙著補 Log4j2 的安全漏洞 (先前在「Log4j2 的 RCE」這邊有提到)，有人整理了目前受到影響的軟體的清單以及對應的討論連結：「Log4Shell log4j vulnerability (CVE-2021-44228) - cheat-sheet reference guide」。
用這包來翻起來會方便一些，另外也可以順便翻一下有什麼其他軟體中獎...
然後 Cloudflare 的 CEO Matthew Prince 在 Twitter 上有提到從他們家的資料看起來，2021/12/01 就已經有攻擊在外面跑了，這也是之前會說這是 0-day 的原因：
Earliest evidence we’ve found so far of #Log4J exploit is 2021-12-01 04:36:50 UTC. That suggests it was in the wild at least 9 days before publicly disclosed. However, don’t see evidence of mass exploitation until after public disclosure.
— Matthew Prince 🌥 (@eastdakota) December 11, 2021
昨天爆出來 Log4j2 的 RCE，看了一下 pattern，只要是 Java stack 應該都很容易中獎：「Log4Shell: RCE 0-day exploit found in log4j2, a popular Java logging package」，Hacker News 上對應的討論在「Log4j RCE Found (lunasec.io)」這邊可以看。
LunaSec 宣稱這是 0-day RCE，不過 Log4j2 的修正版本 2.15.0 在 2021/12/06 出了，而 exploit 被丟出來是 2021/12/09，但不確定在這之前是不是已經有 exploit 在 internet 上飛來飛去了...
丟出來的 exploit sample (CVE-2021-44228-Apache-Log4j-Rce) 是用 LDAP 來打，雖然大多數的 Java 版本不受影響，但還是有其他的面可以攻擊，所以整體上還是很容易打穿，該升級的還是得趕快升級：
Updates (3 hours after posting): According to this blog post (see translation), JDK versions greater than 6u211, 7u201, 8u191, and 11.0.1 are not affected by the LDAP attack vector. In these versions com.sun.jndi.ldap.object.trustURLCodebase is set to false meaning JNDI cannot load remote code using LDAP.
However, there are other attack vectors targeting this vulnerability which can result in RCE. An attacker could still leverage existing code on the server to execute a payload. An attack targeting the class org.apache.naming.factory.BeanFactory, present on Apache Tomcat servers, is discussed in this blog post.
週末苦命時間...