Hacker News Reader

Are you forgetting about log4shell?

log4shell was easier to exploit. It also come with an initial patch that turned out to be incomplete, so everyone had to urgently patch every java web app twice!

View on HN

Log4Shell required that the attacker be able to generate a log message containing specific parameters. It was a severe exploit, but not one that worked in every Java application with the affected Log4j versions. Attackers had to find calls that logged user submitted text or query paths first. So the list of prerequisites was larger: had to be using Log4j and had to have logging of user generated text.

Still a very large attack surface, but not nearly as ubiquitous as this one.

Reply on news.ycombinator.com