WP Jobs Plugin – log4j

  • Resolved rabu78

    (@rabu78)


    4 years, 4 months ago

    Dear all,

    we are using WP Job Manager 1.35.2 and WP 5.8.3. Our security privacy expert now scanned our company site and detected a log4j vulnerability on our url:

    https://www.[company].de/index.php/jobs/

    The result is:

    Parameters:
    ————–

    GET:
lang=${${lOwER:jn}${u
pper:-di:}${LOwEr:-
dn}${LOwEr:s:}${LOw
eR:-//}${:-
subdomain}.domain}

    ————–

    Evidence:
    ————–
    Injecting the payload ${${lOwER:jn}${upper:-di:}${LOwEr:-dn}${LOwEr:s:}${LOweR:-//}${:-
    subdomain}.domain} in the parameter lang triggered a DNS lookup to one of our DNS
    loggers. The payload is the obfuscated equivalent of ${jndi:dns://subdomain.domain} ,
    which will trigger a trigger a DNS query to subdomain.domain via JNDI lookups in Log4j.
    ————–

    So my question is: Is that a false positive? Afaik WP uses PHP and not Java… so in my opinion it cannot be that our WP-site and the plugin is affected by log4j!?

Viewing 6 replies - 1 through 6 (of 6 total)
  • Moderator Yui

    (@fierevere)

    永子

    4 years, 4 months ago

    Likely a coincindence, your system been scanned, so its likely you have log4j somewhere else and your DNS servers are used by vulnerable and scanned system.
    Or its been someone’s curiosity to visit that url in browser

    https://plugins.trac.wordpress.org/browser/wp-job-manager/trunk
    as you can see here is no Java components

    Thread Starter rabu78

    (@rabu78)

    4 years, 4 months ago

    Thanks for your answer.

    The website is hosted on one of the most used hosters in germany – include the DNS servers for the site.

    Only our this single website is stored on the webspace. So what can it be other?

    Moderator Yui

    (@fierevere)

    永子

    4 years, 4 months ago

    So what can it be other

    There are other possible variants, you will have to find/figure that yourself,
    but it cannot be Wp Job manager plugin, nor WordPress itself, nor other plugin or theme which use only PHP code server-side.

    Do you have any access log analyzers, frameworks or components? Does the hoster use them? They are first candidates. It is not WP and does not directly belong to your website, maybe you can ask your hoster too.

    • This reply was modified 4 years, 4 months ago by Yui.
    Thread Starter rabu78

    (@rabu78)

    4 years, 4 months ago

    Hey,

    no we don’t haben any special log analyzers, frameworks or components. It really a simple page on a webhosting package. I will ask my hoster.

    Thank you for your answers.

    Gaurav

    (@gaurav984)

    4 years, 4 months ago

    Hi @rabu78,

    Thanks for reporting the issue. log4j is a data logging package for the Java platform. The code for WP Job Manager does not use Java, the plugin is written mostly in PHP.

    Since the vulnerability does not affect WP Job Manager plugin I am going to close this thread now.

    Please feel free to reach out if you have any questions.

    Best,

    • This reply was modified 4 years, 4 months ago by Gaurav. Reason: Hi 👋 Moderator, please discard/delete this comment. I wanted to close the thread with a comment. I can see that the thread has already been marked as resolved, so my reply is not needed here, :)
    Moderator Yui

    (@fierevere)

    永子

    4 years, 4 months ago

    Gaurav, an _official_ reply from plugin support is always welcome 😉

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘WP Jobs Plugin – log4j’ is closed to new replies.