[logback-dev] [JIRA] (LOGBACK-1591) Possibility of vulnerability

[QOS.CH (JIRA)]

Title: Message Title

Andre Pietsch commented on LOGBACK-1591   Re: Possibility of vulnerability Quoting the original project's Readme.md Note: the upload here is the code I deliberately wrote with file upload vulnerability. It is proposed to propose a possible scenario. It is not the problem of logback itself. Logback only needs this vulnerability to trigger rce. If other vulnerabilities are not used, logback itself is safe Logback offers the ability to load code like this. From my understanding the message of this issue is, that having this kind of functionality in any place is a possible issue. I interpret this as "an easily overseeable way to configure something insecure". As the news entry on the logback homepage mentions, the central thing required is write access to logback.xml. Since an attacker should never get access to configuration files (or even the classpath), this scenario is a lot harder to exploit than the current log4j issue. Both are operating on totally different scales of exploitability. If I misunderstand that, please correct me. Add Comment   This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

_______________________________________________
logback-dev mailing list
logback-dev@qos.ch
http://mailman.qos.ch/mailman/listinfo/logback-dev