[logback-dev] [JIRA] (LOGBACK-1591) Possibility of vulnerability

[QOS.CH (JIRA)]

Title: Message Title

Naozumi Taromaru commented on LOGBACK-1591   Re: Possibility of vulnerability If the attacker can upload (or edit) any file on the classpath, the following steps can be used to execute any code. Step1: Place the Exploit.class file in the classpath. Step2: Place the configuration file in the classpath. <configuration> <appender name="STDOUT" class="Exploit"> <encoder> <pattern>%msg%n</pattern> </encoder> </appender> <root level="debug"> <appender-ref ref="STDOUT" /> </root> </configuration> It is possible to attack without JNDI. I'm sure this is not a Logback's vulnerability. The same is true for Logback's features that use JNDI. Add Comment   This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

_______________________________________________
logback-dev mailing list
logback-dev@qos.ch
http://mailman.qos.ch/mailman/listinfo/logback-dev