Hacker News Reader

Comment by forrestthewoods | Hacker News Reader

Can someone explain exactly what bad thing someone can do with this exploit?

I understand passing a data to a second server and being able to exfiltrate environment vars. (Environment vars are evil.) But I feel like I’m missing a step. How does this let someone take over a machine? How can attacker upload and run their own binary that can actually do real damage?

View on HN

It lets the hacker take over the machine because there are strings which are interpreted as (IIUC, I am not a java engineer) variables within a class, and you can express a remote URL to load a class from, apparently (through something like (jndi://... ldap... URL), resulting in fetching code from somewhere and running it, in the service of writing a log message. This is apparently being exploited in the minecraft ecosystem by simply writing chat messages containing the full exploit, which gets executed by both servers and clients.

> resulting in fetching code from somewhere and running it

Ahhh ok. I didn’t realize the service would fetch and execute. Yikes.

By my understanding the RCE part of the exploit should not apply to recent java versions if the default options are used (minecraft shipped older version afaik, and all bets are off for unmaintained enterprise applications). The data extraction however will work on any java version if the server in question has the capability to connect to a server under the control of an attacker, as the network request will be performed even if the JVM options that should avoid the RCE are enabled. Big problem for client applications (as usually most outgoing connections are allowed). A bit harder to evaluate the impact in the enterprise context as many companies will not allow their servers to connect to "random" endpoints or at least require target-specific proxies to connect to the internet/intranet which makes this harder to exploit.

You can execute arbitrary code into someone's server. You gain full control of whatever the user running your application is allowed to do.

Reply on news.ycombinator.com