The exploit is in the User-Agent
Forty-one requests in one week carried a Log4j lookup expression in the User-Agent header instead of a client name. Twenty-seven of them wrap an environment variable holding Amazon cloud credentials, so a vulnerable logger would resolve a hostname built out of the secret itself and hand it to whoever runs that domain. No response is needed - the lookup is the exfiltration. The remaining fourteen point at the loopback address and only test whether the expression is evaluated at all.
Forty-one requests this week put an attack where the browser name should be.
The client name is decoration. You store it, you count it, you never act on it. That assumption is what this abuses.
Sorted, the forty-one collapse into three payloads. Two of them wrap an environment variable that holds Amazon cloud credentials. Twenty-seven requests carry one of those two.
If the thing writing your log evaluates that expression, it builds a hostname out of the secret and looks it up. Whoever owns that domain reads the answer off their own name server.
No reply is needed. The lookup is the theft.
The other fourteen point at the machine itself. Those are not stealing anything, they are checking whether the expression runs at all.
The dangerous input was never the address. It was the field nobody validates because nobody thought it was an instruction.
Log the header as text. Never as an instruction.
#linux#security#infosec#cloud#sysadmin
❯ Log the header as text. Never as an instruction.