原文地址：https://www.veracode.com/blog/research/exploiting-jndi-injections-java
Java Naming and Directory Interface (JNDI) is a Java API that allows clients to discover and look up data and objects via a name. These objects can be stored in different naming or directory services, such as Remote Method Invocation (RMI), Common Object Request Broker Architecture (CORBA), Lightweight Directory Access Protocol (LDAP), or Domain Name Service (DNS).
In other words, JNDI is a simple Java API (such as 'InitialContext.lookup(String name)') that takes just one string parameter, and if this parameter comes from an untrusted source, it could lead to remote code execution via remote class loading.
When the name of the requested object is controlled by an attacker, it is possible to point a victim Java application to a malicious rmi/ldap/corba server and response with an arbitrary object. If this object is an instance of "javax.naming.Reference" class, a JNDI client tries to resolve the "classFactory" and "classFactoryLocation" attributes of this object. If the "classFactory" value is unknown to the target Java application, Java fetches the factory's bytecode from the "classFactoryLocation" location by using Java's URLClassLoader.
Due to its simplicity, It is very useful for exploiting Java vulnerabilities even when the 'InitialContext.lookup' method is not directly exposed to the tainted data. In some cases, it still can be reached via Deserialisation or Unsafe Reflection attacks.
前言引用來源：https://www.veracode.com/blog/research/exploiting-jndi-injections-java
文章圖片來源：https://www.veracode.com/blog/research/exploiting-jndi-injections-java
－－－－－－－－－－－－－－－－－－－
如果你認同我們每日分享的文章，請幫我們按個讚並且點擊追蹤「搶先看」，讓我們提供最新消息給您！您的分享及點讚，是我們持續推廣資訊安全最大的動力來源。
https://www.facebook.com/LonelyPoPo/
