Listen to this Post
This CVE-2024-6387 is an Arbitrary Code Execution (ACE) flaw within the logback-core library, affecting versions up to and including 1.5.24. The vulnerability resides in the processing of Logback configuration files (like logback.xml). An attacker who has already compromised the application’s configuration file—gaining write access to it—can inject a malicious configuration entry. This entry can specify the class name of an arbitrary Java object to be instantiated by Logback’s configuration parser. The exploit is contingent on the targeted class already being present within the application’s classpath; it does not allow the loading of external classes. When the compromised configuration file is parsed during Logback’s initialization or reload, the parser will reflectively instantiate the specified class by calling its constructor. However, the created object instance is typically discarded immediately by the configuration system, as it is not part of a valid logging appender or layout definition. This limits the direct impact but establishes a vector for unexpected object construction, which could be chained with other vulnerabilities or lead to unpredictable behavior and potential denial-of-service conditions depending on the constructor’s side effects.
Platform: Logback logback-core
Version: <= 1.5.24
Vulnerability : Class Instantiation
Severity: Low
date: Jan 22, 2026
Prediction: Patch by Jan 29, 2026
What Undercode Say:
find . -name "logback.jar" -exec jar -tf {} \; | grep "ch.qos.logback"
<!-- Example of a suspect configuration line --> <timestamp key="byMal" datePattern="yyyyMMdd'T'HHmmss" timeReference="contextBirth"> <javaBeansPropertyEditor /> </timestamp>
Check for vulnerable version in pom.xml or gradle files grep -r "logback-core" pom.xml build.gradle
How Exploit:
Attacker writes malicious `logback.xml, pointing to a dangerous class constructor on the classpath (e.g., javax.script.ScriptEngineManager). Application reloads config, triggering instantiation.
Protection from this CVE
Upgrade logback-core to version > 1.5.24 (e.g., 1.5.25) when released. Restrict write permissions on Logback configuration files. Implement integrity checks (e.g., file hashing) on config files. Use security tools to monitor for unauthorized file changes.
Impact:
Low severity. Requires pre-existing class and write access to config. Instantiated object is usually discarded, limiting immediate damage. Serves as a potential foothold for further exploitation chains.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
