Notes

Log4Shell: The Worst Java Vulnerability for Years

On Dec. 9 2021, a zero-day exploit (since dubbed "Log4Shell") was discovered in the wild targeting an important RCE vulnerability in Log4j, the widely used open source logging tool. According to NIST, affected versions of Log4j contain JNDI features in log messages, configuration and parameters that don't safeguard against LDAP that is controlled by an attacker and other JNDI connected endpoints. Numerous platforms appear to be affected, including Apple, Cloudflare, and Twitter, in addition to the myriad of well-known Java ecosystem products with Log4j integrated into their supply chains for software including Logstash, Apache Kafka, Elasticsearch, and even Minecraft.



The Log4j vulnerability is being viewed as the most serious vulnerability in the last few years. It may even be more serious than the CVE-2017-5638 flaw in Apache Struts RCE that led to the massive breach of Equifax. The latest vulnerability, according to Bugcrowd founder and CTO Casey Ellis is a toxic mix of a massive attack surface and easy exploitability, as well as a hard-to-elude dependency and extreme virality. Among other things, it's an indication that supply chains for software have become deeply complex, with layered inter-dependencies that are usually beyond the reach of automated tools like scanners.



It will provide an opportunity for clarity for organizations that have yet taken a platform-powered, continuous security testing approach. This method combines technology, data, and human intelligence to find and address vulnerabilities before they cause harm. In a future blog post, we'll describe how that approach helped Bugcrowd verify that it validates, contextualizes, and communicate Log4Shell exposures to customers within hours.



In the meantime, we're eager to assist you by providing:



1. For continuous crowd-powered, continuous detection of Log4Shell exposures at your perimeter There is a 30-day "Log4j on Fire" bug bounty solution. Minecraft Start by reading the details. 2. This Security Flash video features Casey Ellis and Adam Foster, Application Security Engineers. It provides deeper insights into the vulnerability profile of this vuln as well as future impact. 3. Next week, Casey will host a live Q&A session at 10 o'clock PST. She will be able to answer all your questions regarding the Log4j exploit and the Log4Shell exploit. Save your seat here. 4. Here's a single view of all our Log4j/Log4Shell resources.



We are super proud of our customers, researchers, and team members who are working tirelessly to make our digitally connected world safer in this time of crisis. We'll make it done, just like we always do!


My Website: https://minecraft-servers-list.co/