Technical Tag
2 related articles.
Preface A tweet last night attracted considerable attention in the security community. Log4j 2.17.0 has RCE!! Yet the community mostly scoffed: RCE after modifying a configuration file—is that all? So how did configuration-file RCE become fashionable? The story begins…
0x01 Preface While following up on Log4j 2, I found several interesting details and recorded them here. 0x02 Is Log4j Never Vulnerable to JNDI Injection? First, a question: is Log4j never vulnerable to JNDI injection? No. I found an interesting exchange in a Log4j 2 pull request. Someone argued that Log4j is vulnerable…