关于现在的 log4j2 漏洞的系统变量缓解方法

2021-12-10 16:06:26 +08:00
 plasmetoz
我查到的是

临时缓解措施：
1. 禁止没有必要的业务访问外网
2. 使用 jvm 参数启动 -Dlog4j2.formatMsgNoLookups=true
3. 设置 log4j2.formatMsgNoLookups=True
4. 系统环境变量中将 FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS 设置为 true

但是我测试 4 在 linux 下 export FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS=true 好像不起作用，查看 log4j2 的代码里面

@Deprecated
public static final boolean FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS = PropertiesUtil.getProperties().getBooleanProperty("log4j2.formatMsgNoLookups", true);

似乎也只是变量名称。。。是我理解错了吗？
4120 次点击
所在节点    Java
12 条回复
vast0906
2021-12-10 16:09:13 +08:00
官方的 release 包似乎正在发布
plasmetoz
2021-12-10 16:10:55 +08:00
@vast0906 #1 是，但是现在打算先紧急维护一下，以为方法 4 用了以后把 java 服务全重启一下就行了，结果好像不行
zhady009
2021-12-10 16:18:32 +08:00
可以试试改 pattern 把%m 或者%msg 改成%m{nolookup}
cheng6563
2021-12-10 16:24:24 +08:00
用这个吧 JAVA_TOOL_OPTIONS=-Dlog4j2.formatMsgNoLookups=true
plasmetoz
2021-12-10 16:29:44 +08:00
@cheng6563 #4 多谢，这个看起来可以
wbd31
2021-12-10 16:54:00 +08:00
formatMsgNoLookups 这个参数是 2.10 版本才加上的，对于之前同样受漏洞影响的版本无效
silverfox
2021-12-11 01:20:33 +08:00
@zhady009 这里少了一个 s ，应该是改为 %m{nolookups}
huage
2021-12-11 21:42:20 +08:00
Remediation Advice:

This issue was remediated in Log4J v2.15.0. The Apache Logging Services team provides the following mitigation advice:

In previous releases (>=2.10) this behavior can be mitigated by setting system property "log4j2.formatMsgNoLookups" to “true” or by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Java 8u121 protects against RCE by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".

You can manually check for use of affected versions of Log4J by searching your project repository for Log4J use, which is often in a pom.xml file.

Where possible, upgrade to Log4J version 2.15.0. If you are using Log4J v1 there is a migration guide available.

Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.15.0 where possible.

If upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set on both client- and server-side components.
troywinter
2021-12-11 23:27:42 +08:00
JDK versions greater than 6u211, 7u201, 8u191, and 11.0.1 are not affected by the LDAP attack vector. In these versions com.sun.jndi.ldap.object.trustURLCodebase is set to false meaning JNDI cannot load a remote codebase using LDAP.
44670
2021-12-12 03:00:50 +08:00
LOG4J_FORMAT_MSG_NO_LOOKUPS=true 似乎也可以
https://logging.apache.org/log4j/2.x/security.html

感觉 FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS 是国内的以讹传讹。
Kaiv2
2021-12-12 08:48:22 +08:00
@44670
https://github.com/apache/logging-log4j2/commit/3bd68c1db9b372c5c338ba9108af10828589157a#diff-8bdc174b15f96bd9027d5d631f5a7e79d40db0a17983daea471e4197f75e01bc

这是后面有人修改了
44670
2021-12-12 14:30:17 +08:00
@Kaiv2 看来是 log4j 的文档就写错了，好怪。

这是一个专为移动设备优化的页面（即为了让你能够在 Google 搜索结果里秒开这个页面），如果你希望参与 V2EX 社区的讨论，你可以继续到 V2EX 上打开本讨论主题的完整版本。

https://tanronggui.xyz/t/821360

V2EX 是创意工作者们的社区，是一个分享自己正在做的有趣事物、交流想法，可以遇见新朋友甚至新机会的地方。

V2EX is a community of developers, designers and creative people.

© 2021 V2EX