Fuzzing Java to Find Log4j Vulnerability - CVE-2021-45046

After the log4shell (CVE-2021-44228) vulnerability was patched with version 2.15, another CVE was filed. Apparently log4j was still vulnerable in some cases to a denial of service. However it turned out that on some systems, the issue can still lead to a remote code execution. In this video we use the Java fuzzer Jazzer to find a bypass.

00:00 - Intro
00:54 - Chapter #1: The New CVE
03:38 - Chapter #2: Disable Lookups
05:43 - Chapter #3: Vulnerable log4j Configs
07:52 - Chapter #4: The Remote Code Execution
10:53 - Chapter #5: Parser Differential
12:57 - Chapter #6: Differential Fuzzing
16:07 - Chapter #7: macOS Only
18:15 - Chapter #8: Increase Impact
19:03 - Summary
19:58 - Outro

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

[rinzler_d_vicky]

As a dev I never thought of security in such detail, but after watching this channel I have been practicing to analyse my code for vulnerability and avoid developing features that can be used as vulnerability in combination.
My favourite approach is to never make a magic function.
Thank you!

[FaultyMuse]

As a professional Java developer, I have never once heard someone call log4j "Log Forge". And considering the name literally means "Log for Java", I would argue anyone saying "Log Forge" is wrong. Although i suppose this is probably just another gif situation lol

[VLS-Why]

Now you just need to put a sudoedit payload in a log4j injection xD

[Dndo]

For anyone wondering how did they fix this difference in URI parsing behaviours -> They didn't. They just completely removed the whitelisting checks and restricted the whole shebang to only `java` scheme, so no LDAP URIs would pass through.

[EER]

Great dive into this CVE, since I don’t work with Java I took this one as an FYI so it’s great to come across an easily digestible report on it. 😄

[jrmiasmg]

Missed opportunity to play some jazz while the fuzzer runs. Thanks for the video.

[koooqgg]

It's always worth it.. watching the content you make.

[logiciananimal]

Jazzer looks neat - thanks for the reference.

[PavelTimofeev]

Great video, thank you!
I feel something is missing in the video - still nor clear why MacOS and alpine are affected? Maybe other operating systems? Why?
Probably because of different libc implementations that provide DNS resolution functionality.

[ThistleBlue]

Training to be a Java SDET and we're covering Log4J tomorrow..time to learn beforehand haha

[kallocainsynthemesc]

Wünsch mir mehr java videos von dir. Weiß du machst nicht viel mit Java, aber es ist relevanter für Programmierer (weil beliebte Sprache). Keep up the good Content junge

[eebba]

18:10 'Z'ystems :D 🇩🇪
continuing the sentence they become system again :D

[MuhammadBinZafar]

This was a fruitful collaboration. Thanks @liveoverflow for the insights. It's always amazing to see top hackers coming together!

[krzysztoflewandowski]

Just curious if you have noticed CVE-2017-5645? Probably very early sign of the novadays problems

[MVMn]

How can you inject your code via this localhost#<something> URLs though? You say "the connection worked" for the other dude, but the connection to what? There clearly can't be a doman like localhost#<my attacker site> - so how did he actually inject something? What did the DNS resolve and how could it resolve anything at all? o_O

[mohamedjames]

thank you very much for this asome video .does Anthony Weems has a youtube channel?

[doktoracula]

8:44
Nah, it doesn't look good, still seems overly complex. Too many nested ifs, this could use the early return pattern. Which you definitely should use whenever you do safety checks, you should return instantly when anything is wrong and do operations only when all is right.

[Hexcede]

So, the bypass was found through a parser differential. But it only works on MacOS... Because of a parser differential 😳

[Mayurdusane]

Man Man Man !!! You over simplified that initial statement. I understood this in half sleep.

[KeinNiemand]

but woudn't the remote code execution requre that somone actually registers the localhost# domain witch is impossible since it's invalid. Even if someone is running macos and it parses the invalid hostname the dns server shoudn't return anything since the hostname is still invalid. So this is actully not exploitable unless the DNS server is also vunerable or the attacker controls the dns server.