search

Glavo / log4j-patch

Non intrusive log4j2 RCE vulnerability patch.
Do What The F*ck You Want To Public License
66 stars 8 forks source link

crash in Minecraft 1.7.10 #1

Open xmdhs opened 2 years ago

xmdhs commented 2 years ago 
Exception in thread "main" java.lang.NoClassDefFoundError: JNDI lookup is disabled
        at org.apache.logging.log4j.core.lookup.JndiLookup.<init>(JndiLookup.java:11)
        at org.apache.logging.log4j.core.lookup.Interpolator.<init>(Interpolator.java:66)
        at org.apache.logging.log4j.core.config.BaseConfiguration.<init>(BaseConfiguration.java:108)
        at org.apache.logging.log4j.core.config.DefaultConfiguration.<init>(DefaultConfiguration.java:48)
        at org.apache.logging.log4j.core.LoggerContext.<init>(LoggerContext.java:63)
        at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.locateContext(ClassLoaderContextSelector.java:217)
        at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.getContext(ClassLoaderContextSelector.java:114)
        at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.getContext(ClassLoaderContextSelector.java:81)
        at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:83)
        at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:34)
        at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:387)
        at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:322)
        at bao.<clinit>(SourceFile:84)
        at net.minecraft.client.main.Main.main(SourceFile:72)

原因大概是 1.7.10 使用的 2.0-beta9，没有尝试去捕获 new JndiLookup 可能产生的错误吧 https://github.com/apache/logging-log4j2/blob/log4j-2.0-beta9/log4j-core/src/main/java/org/apache/logging/log4j/core/lookup/Interpolator.java#L66

Glavo commented 2 years ago 
Exception in thread "main" java.lang.NoClassDefFoundError: JNDI lookup is disabled
        at org.apache.logging.log4j.core.lookup.JndiLookup.<init>(JndiLookup.java:11)
        at org.apache.logging.log4j.core.lookup.Interpolator.<init>(Interpolator.java:66)
        at org.apache.logging.log4j.core.config.BaseConfiguration.<init>(BaseConfiguration.java:108)
        at org.apache.logging.log4j.core.config.DefaultConfiguration.<init>(DefaultConfiguration.java:48)
        at org.apache.logging.log4j.core.LoggerContext.<init>(LoggerContext.java:63)
        at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.locateContext(ClassLoaderContextSelector.java:217)
        at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.getContext(ClassLoaderContextSelector.java:114)
        at org.apache.logging.log4j.core.selector.ClassLoaderContextSelector.getContext(ClassLoaderContextSelector.java:81)
        at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:83)
        at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:34)
        at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:387)
        at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:322)
        at bao.<clinit>(SourceFile:84)
        at net.minecraft.client.main.Main.main(SourceFile:72)

原因大概是 1.7.10 使用的 2.0-beta9，没有尝试去捕获 new JndiLookup 可能产生的错误吧 https://github.com/apache/logging-log4j2/blob/log4j-2.0-beta9/log4j-core/src/main/java/org/apache/logging/log4j/core/lookup/Interpolator.java#L66

嗯，所以其实已经提供了一个 log4j-patch-beta9.jar，不过暂时还没写文档。

xmdhs commented 2 years ago

抱歉没有看到。

另外就是，能否提供一个 javaagent 的版本。