Widespread exploitation of critical remote code execution in Apache Log4j
We just spend the better part of the day going through applications and figuring out if they use log4j, if so which version, fixed code, notifying customers. Then we remembered that the majority of our servers can't actually reach the internet. They only accept requests, they cannot make outbound requests to the internet.I know it a little old fashion, as explained to me by a customer earlier this year. In the age of cloud, people expect their servers to have a direct internet connection.It's annoying to work with, but ideally your devices should only be able to reach the internet via a proxy and/or only whitelisted hosts. Understandably there are cases where this just isn't an option, but really do consider if your server truly needs to communicate with the internet at large. Can you use an HTTPS proxy, and just whitelists the required domains? The answer is most often "Yes", it's just a little more work.