Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JndiManager #182

Open
arykov opened this issue Dec 20, 2021 · 2 comments
Open

JndiManager #182

arykov opened this issue Dec 20, 2021 · 2 comments
Assignees
@xeraph
Labels
discussion question or suggestion

Comments

@arykov
Copy link
Contributor

arykov commented Dec 20, 2021

Having looked at a number of scanning and remediation utilities some appear to remove JndiLookup, some JndiManager. It seems that JndiManager is the one that does the actual JNDI lookup in more recent versions, but there are paths that lead to its execution, other than from JndiLookup. JmsManager and JndiContextSelector are other examples. Is it worth whacking both JndiLookup and JndiManager? I suppose it will break JMS logging.
@xeraph
Copy link
Contributor

xeraph commented Dec 21, 2021

Which version do you mean, Log4j2 or Log4j 1?

@xeraph xeraph self-assigned this Dec 21, 2021
@xeraph xeraph added the discussion question or suggestion label Dec 21, 2021
@arykov
Copy link
Contributor Author

arykov commented Dec 21, 2021 •
edited
Loading

Log4j2.
References

  • lunasec detects based on hashes specified here. The fact they use hashes is beside the point, but have a look at the version/file combo

  • Palantir sniffer goes after JndiManager. Did not check their code

  • Cloudera goes after JndiLookup.class

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@xeraph xeraph

Labels
discussion question or suggestion
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@arykov @xeraph