general

[quasi valley]

[spice crane]

bigrat.monster

[left swift]

krusic bro

[worn ember]

havent looked into it lol, but its not that hard

[void void]

ASM otaku

[left swift]

with a syringe

[daring owl]

How bad is it

Is it like a coordinate exploit or like code executtion

[left swift]

well look at it lie this

it got an everyone ping in the papermc discord

that should help you gauge how bad it is

[robust oxide]

9.8/10 rating

[worn ember]

fitsmc video wen

[peak ginkgo]

https://www.spigotmc.org/threads/security-releases-—-1-8-8–1-18-1.537204/

btw, spigot post.

[left swift]

THE WORST EXPLOIT IN MINECRAFT HISTORY

[fiery saddle]

One probably exists as it is just backporting a fix

[limber knot]

nah

[worn ember]

md not being late to the party for once

[ashen cliff]

Even did all the versions.

[worn ember]

yeah

[oblique jungle]

imagine not knowing the string to crash the server

[worn ember]

dammit

[left swift]

that should also

[worn ember]

shouldve let the old versions to rot lmao

[left swift]

tell you how bad it is

[worn ember]

its funny cuz this exploit is like super old

[left swift]

went all the way back to 1.8.8

[oblique jungle]

still works on 1.8+ btw

as long as it uses logj4 2

[left swift]

such a nice guy

[wooden isle]

What does the exploit allow for?

[peak ginkgo]

Well now we can send Paper 1.8 users to Spigot so not our problem

[left swift]

drugs

[oblique jungle]

crash a server

[peak ginkgo]

Crash 👍

[oblique jungle]

instantly

[worn ember]

as if we didnt already

[peak ginkgo]

kek fucking w

[oblique jungle]

by pasting something in chat

[unique mortar]

Is the exploit only able to affect the server, or do we know for certain it can affect clients end accounts?

[tropic flame]

so this means Paper is behind Spigot on 1 commit in all the older versions

[marble trench]

How does this exploit work ? I wanna try it to see if i'm vulnerable

[tropic flame]

i mean, we can just fork and sync upstream i guess? but still, quite funny

[worn ember]

if they can do it on your client you have bigger issues lol

[peak ginkgo]

The client thing is IN THEORY, we've seen noone run code on a client yet.

[peak ginkgo]

Pins in #paper-help is all we've got

[left swift]

why are all these exploit questions leaking into general chat now

go away

[unique mortar]

Ahh okay, yeah just making sure. Thanks for the speedy responses.

[worn ember]

i got a tool that can do the exploit but its 0.5btc

[peak ginkgo]

ded trying to pay off college

[limber knot]

paper general is only for mild shitposting and trolling

[worn ember]

yes

[left swift]

only $24k what a deal

[limber knot]

no

[peak ginkgo]

too real

[grand isle]

Yo what is happening

[oblique jungle]

bannable if posting exploit in this discord?

[worn ember]

i'll dm it to you for free 😉

[swift root]

Yes.

[oblique jungle]

ight

[left swift]

this pfp should be bannable

larrypls

[snow perch]

wait

where is the ping

hi

no :D

ok

hes duper trooper

epic yt

dont ban

ty

[limber knot]

what the fuck is that a trumpet in my shoegaze????

[golden gust]

If you're just here to flood the channel you will be booted.

[foggy silo]

Holy cow

[snow perch]

no no

[foggy silo]

Cat you saved yourself there x)

[left swift]

[foggy silo]

Paperhelp is flooding

[snow perch]

;-;

[limber knot]

cat being based, for once

[golden gust]

!ban @void void Go be annoying elsewhere

[thorny flicker]

:raised_hands: Banned Grass#0926 (Go be annoying elsewhere) [1 total infraction] -- electronicboy#8869.

[potent magnet]

should I load my world on my personal pc then move it over the my server

instead of making chunky run for 12 hours on my server

[limber knot]

i think me sending cat shoegaze made him a little triggerhappy

[left swift]

what would be the point

[distant trout]

y ban duper

[potent magnet]

would it not be faster?

[distant trout]

smh

[void void]

Please don't link that since it contains a POC

[limber knot]

hey noah

[swift root]

Yeah deleted. Thanks Noah

[void void]

Hi naomi

[limber knot]

irc remembers all.

[void void]

#general is lovely after a @ everyone ping

[limber knot]

yeah

[swift root]

Always is

[minor furnace]

Is the log4j vulnerability fixed in this version of Velocity? https://github.com/PaperMC/Velocity/commit/2cff5b3b021f87289e4880f9bbec81320f5643de

[void void]

Yes

[minor furnace]

awesome

[limber knot]

cant wait to see >2k messages in every channel when i wake up again in 6-7 hrs

[potent magnet]

chunky a lot faster on my pc than on my server

[ashen nacelle]

it only 5:18pm Here

[limber knot]

yes but i dont live where you live

[potent magnet]

yeah on my pc it reached the same point my server got to in 1/10th of the time lol

consistently about 3x faster

[ashen nacelle]

the poc is on github which means everyone knows it now

[worn ember]

news flash, your pc has more resources than your server

thats what happens if you run on shared hosting lol

[potent magnet]

right, but someone said "What is the point"

[limber knot]

news flash, ded is a hardware expert

[worn ember]

true

[limber knot]

gl transferring all the files tho

[worn ember]

hardware is hard, software is not

[solemn geyser]

what exactly is the scope of the exploit? have any technical details been released?

[limber knot]

ded how good is your x86_64 asm

[worn ember]

remote code execution

[fossil patio]

on old java versions

[void void]

Can we get an exploit slash command?

[limber knot]

kashike pls

[faint wing]

I don't see how the exploit could be used in mc though

[potent magnet]

mc is java bro

[peak ginkgo]

@faint wing someone pastes a funy lookin message in your server chat

server crashes

👍

[solemn geyser]

where exactly? i saw libs mentioned but is there one in specific?

[faint wing]

Yeah, that's what everyone keep saying

[tropic flame]

yeah, the Log4J GitHub repository has the commits that fix the exploit. it's a remote code execution exploit. it can run code in your machine.

[solemn geyser]

if you can RCE on the host machine or even the container, you can access the MC server

[faint wing]

but it also requires an error from the user of the library it seems to me

[solemn geyser]

(am a sys/netadmin)

[faint wing]

like an sql injection kind of thing

[worn ember]

thats why you run your server as root btw

[solemn geyser]

Thanks for the info

[faint wing]

just passing raw strings to your logger

[solemn geyser]

🤣

[limber knot]

if i ever finished the mc server i started

[ashen nacelle]

https://tenor.com/view/brooklyn-nine-nine-test-results-dumb-dumbass-you-are-so-stupid-gif-14192289

[worn ember]

you wont

[worn ember]

jokes on you, it doesnt hurt me

[potent magnet]

how many chunks should I stop at with chunky

on an smp

[limber knot]

i would just write a little ""virus"" into it that does an rm -rf / --no-preserve-root

[potent magnet]

currently at like 77k

[limber knot]

go until it's finished, ez

[potent magnet]

I did 10k radius

since I could just stop whenever

but even on my pc it'll take 3 hours

[solemn geyser]

kinda sorta. I've yet to read on how the exploit works but an attacker could pass a linux command through to the system running the server. if you're running something like ptero, the damage will be isolated to that server/container, if you run your servers on the host itself, then it can affect all your servers (in general. there's obviously a lot of nuance to it)

[potent magnet]

jokes on you I run my servers on a windows vm on my raspberry pi

[marsh charm]

what is the scope of the log4j thing? rce with permissions of user running the server? do they have to be whitelisted to exploit it?

[solemn geyser]

shudders

[ashen nacelle]

and wipe out the linux system and in the case of a MSI laptop permantly brik the UEFI

[worn ember]

just install windows

[tropic flame]

MSI laptops literally break themselves without user intervention anyways

[worn ember]

ez

[tropic flame]

you don't need a virus

[peak ginkgo]

Just a crash 👍

[marsh charm]

okay thx

[faint wing]

potentially an rce

[grizzled fjord]

It only crashes server if spamming a lot

[peak ginkgo]

it's a "in theory, yes rce"

but noones done it yet

[worn ember]

i feel like it could be exploited further if you went deep into it, but too much reading to figure out exactly what lol

[peak ginkgo]

so... maybe.

[viscid wedge]

I fucking hate MSI, but this isn't specific to them. Any board that lets you r/w efivars can be bricked this way

Well, "bricked"

[solemn geyser]

can someone link me the commit in the log4j repo so I can see how it actually works?

[grizzled fjord]

Almost nobody is concerned with RCE, only affect old Java builds (even Java 8 is patched since build 120)

[faint wing]

I can't even figure out what I have to read

[peak ginkgo]

We're not doing like open discussion about it here.

[void void]

@molten zodiac hey weren't you a owner on 0b0t?

[peak ginkgo]

Bad people lurk this Discord for the smallest inkling of Paper fucking up purely to cause chaos, so we're not gonna talk about it. 👍

You can FIND it, but noone here's gonna help @solemn geyser

[viscid wedge]

Check GitHub, the commits are all public

[ashen nacelle]

https://tenor.com/view/spongebob-squarepants-several-bad-decisions-later-fml-fuck-my-life-my-bad-gif-17544624

[grizzled fjord]

Tested the exploit, not working on ANY server if your Java is up to date (even Java 8)

[sand wharf]

So, is the exploit fixed on the newest versions of paper/spigot?

[grizzled fjord]

(I mean the rce, still can crash)

[viscid wedge]

Okay I'm just gonna avoid this Discord for the next week, the everyone ping brought in all the dumbasses

[void void]

imagine doing this on 2b2t lol

[viscid wedge]

imagine touching grass

[void void]

true

[pastel dune]

How can i test this on my server?

[grizzled fjord]

those poc on the internet are using old Java 8 builds from 2017 u_u

[ashen nacelle]

taking jahy with you soup

[limber knot]

hello soup

[grizzled fjord]

8*

[void void]

how exactly?

[viscid wedge]

see you later naomi

[worn ember]

nothing of value lost

[grizzled fjord]

dyor, not gonna talk about it more

[dreamy egret]

Too late

[void void]

was it patched

[dreamy egret]

It was performed

[void void]

LOL

[grizzled fjord]

just relax, your servers are safe if u installed / updated it in the 3 last years

[dreamy egret]

And 2b is down rn

[limber knot]

i'll get my discord acc back soon, to troll some sense into the kids

[jade knot]

What is an orange?

[void void]

dont listen to papermc mods!!! they are trying to forcfe you to update your java to a version built since 20fucking17! HOLD YOUR GROUND and run 1.7 on java 6!!!!!!!!!!1

[limber knot]

an orange is a round citrus fruit that grows on trees

[void void]

wrong

that is a purple

downgrade to java 1 to fix the exploit btw 🙏

[tame frigate]

Lmao

[robust oxide]

don't you mean uninstall java?

[jade knot]

Being vulnerable is the vulnerability! :P

[void void]

uninstall java, install ransomware

[limber knot]

rosa reimplements the jvm in rust when

[ashen nacelle]

wannacry ftw

[void void]

no server =safe server

[void void]

soontm

[limber knot]

lets go

no more buffer overflow exploits in MY jvm

no more memleaks

[mild rune]

naomi don't make me buffer overflow irc

[limber knot]

mja dont make me buffer overflow your aorta.

ok

[jade knot]

I'll take your memleaks off your hands and fill a McDonalds medium cup with it

[mild rune]

that's kinda hot 😳

[void void]

the c in cpp stands for pain and cuferring

the r in Rustlang stands for based

[limber knot]

the c in cpp stands for crap

ez

[mild rune]

the c in cpp stands for cracked

[shell surge]

how can you stand a green terminal

[mild rune]

my terminal is green

just less terrible

[shell surge]

xterm256 exists for a reason

[limber knot]

the m in V stands for magnificent

[mild rune]

see

pins in #paper-help

[limber knot]

check pins

[mild rune]

bro enter is not a spacebar

[worn ember]

reading real hard

[mild rune]

me no read

how do werk?

[limber knot]

im gonna abuse clipboard history

[mild rune]

why

yes we know md5 patched every version

do we care?

probably not

[plucky sparrow]

How’s dart

[limber knot]

ew

[plucky sparrow]

you’re ew

[limber knot]

not having anything other than int and double makes it basically the same as elshout

[swift root]

dart is fine

[plucky sparrow]

why does it bother you so much naomi

You can just get a library if you need it so damn much

[limber knot]

that's the thing

there is no library for it

i had more than 20 tabs open trying to find one, aight?

like yeah i like the language but not having byte, short etc is kinda a dealbreaker for me

[mild rune]

naomi stop using esoteric langs

just write valk in c

[limber knot]

also haha my phone 69 percent https://naomi.s-ul.eu/9WBTR9Hm

[foggy silo]

Nice.

[ashen cliff]

It's a valid patch. Different approach to not break things.

[foggy silo]

Naomi what time is it for you

[limber knot]

23:40

[ashen nacelle]

11:40PM

[limber knot]

11:40pm for 12 hr clock plebs ye

[foggy silo]

Americanians

[ashen nacelle]

and i like my Farenheit!

[limber knot]

then why do computers prefer celsius?

checkmate.

[void void]

papermc exploit involving how log4j handles the conversion of text

[ashen nacelle]

mine all display in Farenheit.

[plucky sparrow]

furenhai better becaus you feel the changes

‘murica land of the free

[limber knot]

not just a papermc exploit, ivx

but yeah dap, dart is cool but not right for a minecraft server

[plucky sparrow]

Then why say ew

[void void]

welp

[plucky sparrow]

You dum

[mild rune]

naomi isn't it past your bedtime

[limber knot]

yes

[mild rune]

nice

[limber knot]

but i am in bed already

[mild rune]

oh

[ashen nacelle]

nah she a working girl

[mild rune]

ok

[limber knot]

been for a while

[ashen nacelle]

working til the sun rises

[mild rune]

I haven't gotten out of bed today

[limber knot]

i did work on stuff today yeah wooo

[worn ember]

wow

nomi being useful

[plucky sparrow]

I might actually do dap’s personal platform blogging in flutter

Looks easy enough

[limber knot]

sounds like a good idea

write the backend in Go for cool points

[plucky sparrow]

Ew

[limber knot]

golang good tho

[plucky sparrow]

No ty

[ashen nacelle]

https://tenor.com/view/omori-omori-mari-go-to-bed-go-to-sleep-omori-game-gif-23773198

[stray bay]

Can i still play on hypoxel or nah

pixel*

[plucky sparrow]

careful

[limber knot]

how are we supposed to know

[stray bay]

so no?

[limber knot]

have you tried?

hypickle doesnt use paper, they use their own custom fork pretty sure

[void void]

Clients are also affected though

[ashen nacelle]

as big as hypixel is they probably have their own proprietary jar files.

[void void]

They run 1.7 with 1.8 compat hacked on top

[limber knot]

yeo

[ashen nacelle]

remember the days of the mineshaft client

[ember tinsel]

will papermc patch this anytime soon?

[limber knot]

already been patched

[ashen nacelle]

i first used m,ineshaft before actually buying minecraft

[ember tinsel]

oh good

[limber knot]

read pins in #paper-help

[obtuse fossil]

It's been patched for 1.16, 1.17 and 1.18

[ember tinsel]

my server uses 1.16, dont ask, so ima update to latest

[obtuse fossil]

the latest on the website won't work, use this one https://papermc.io/api/v2/projects/paper/versions/1.16.5/builds/791/downloads/paper-1.16.5-791.jar

[ashen nacelle]

wget -o https://papermc.io/api/v2/projects/paper/versions/1.17.1/builds/398/downloads/paper-1.17.1-398.jar

[limber knot]

curl https://papermc.io/api/v2/projects/paper/versions/1.17.1/builds/398/downloads/paper-1.17.1-398.jar -o paper.jar

[ashen nacelle]

curl is better when downloading multiple files for a single file i will use wget.

[void void]

wrong

[cloud moat]

curl -fsSL https://papermc.io/api/v2/projects/paper/versions/1.17.1/builds/398/downloads/paper-1.17.1-398.jar -o paper.jar

[mild rune]

just write the raw binary to a file by hand

[ember tinsel]

ok i uploaded the jar to my server

hopefully it doesnt f anything up foreshadowing

[stiff widget]

Is there a cve for the RCE exploit?

[limber knot]

just ask cat to deliver a usb thumbdrive with the latest paper build, mja

[void void]

pretty sure there isn't one yet

[median glade]

my friend is being dumb

lmao

[ember tinsel]

naomi why are you a bot

[cloud moat]

Nope there isn't

[limber knot]

i am an advanced AI

[void void]

artificial "intelligence"

[ember tinsel]

what's 10 divided by 0

[vernal moth]

There is no confirmed RCE

[limber knot]

ArithmeticException: Divide by zero

[median glade]

this kid

[ashen nacelle]

https://tenor.com/view/explosion-mushroom-cloud-atomic-bomb-bomb-boom-gif-4464831

[brazen marsh]

rm -rf /

[hexed dragon]

Active chat prob going to die tomorrow.

[stiff widget]

https://images-ext-1.discordapp.net/external/98QEs0El8LR9S2VONVBthGYSeFhe_KQU60N_NrOeaxI/https/media.discordapp.net/attachments/862403689091432448/918630413952503808/unknown.png

[limber knot]

Permission denied.

[median glade]

"dOeSnT hYpIxEl rUn oN jAvA?"

[brazen marsh]

sudo rm -rf /

[ember tinsel]

$sudo SubToYT: AfkUser

[limber knot]

imonsay is not in the sudoers group. This incident will be reported.

[median glade]

$sudo KillSomeone: AfkUser

[limber knot]

my favourite unix utility, od.

[median glade]

yeye

I love the KillSomeone cmd

:)

[void void]

.kill Epicster

[limber knot]

beheads Epicster with a chainsaw and uses their head to play football.

[median glade]

NO

gr

.kill Noah

[ashen nacelle]

su root ***********
rm -rf / --no-preserve-root

[limber knot]

turns Noah into a snail and covers them in salt.

[ember tinsel]

naomi am i cool

[median glade]

L

@ember tinsel no

[limber knot]

no.

[median glade]

L

[ember tinsel]

ok good to know

[limber knot]

adam, you know you can just do su - right?

you can on BSD at least

[ashen nacelle]

closing time off to home

[ashen cliff]

Daily life with Debian. Better not forget that -.

[limber knot]

i usually just do su -i

but using root, lol

[peak ginkgo]

I informed Minehut of how fear mongery this is and they're working on it

To my knowledge a Minehut wide fix is going out

[foggy silo]

Honestly creating more chaos is just what we needed lol. Thanks for telling them

[spice ether]

[median glade]

smh

[vernal moth]

Some of hypixels servers run paper

Most don't

[peak ginkgo]

Hypixel SMP runs Paper

[median glade]

yes exactly

[peak ginkgo]

Whatever the latest version of Paper is whenever you start it lmao

[foggy silo]

Oh really? That’s interesting

[median glade]

That's my point

[stiff widget]

Also doesn’t the -Dlog4j.formatNoMessage=true aguement fix

The vulnerability client side

[coarse lily]

Shout out to the Paper mods for dealing with the huge influx of stuff today.

[vernal moth]

If you add it to your client

[solemn geyser]

do the openjdk docker images for java 8, etc have this patched already?

[cloud moat]

I use Arch btw

[limber knot]

hello ocelot

[median glade]

I agree

[limber knot]

i have a FreeBSD VM btw.

[cloud moat]

It's not in Java it's in the Applications that use it

[cloud moat]

I have a TempleOS VM

[stiff widget]

Who found the vulnerability?

[limber knot]

chinese researches at AliBaba

[solemn geyser]

makes sense, so just anything that uses log4j?

[stiff widget]

Yea

[vernal moth]

A paper user who informed us via the exploit report channel

[median glade]

is this kid stupid or stupid

[vernal moth]

Stop posting the same dum screenshot

We don't care

[limber knot]

he is NotFunny

[median glade]

ok I will

stop

[foggy silo]

Hi mini!

[limber knot]

imagine trying to be funny in paper general

[wraith coyote]

Yo

[stiff widget]

Where do find the specifics of the exploit?

[foggy silo]

Impossible!

[limber knot]

the being funny privileges are reserved for regulars.

[night forge]

How can you not get ratted lol

[vernal moth]

Specifics shouldn't be public

[stiff widget]

Oh yea i forgot about that

So no CVE yet?

[limber knot]

nope

[stiff widget]

Or mc bug tracker

[vernal moth]

Mojira ticket was the first thing we did

It's obviously private

[stiff widget]

Ok

[limber knot]

im sad i dont have money to buy Yuragi :c

[hexed dragon]

They could probably add it in by tomorrow release.

[foggy silo]

..

[limber knot]

if mojang shipped yuragi with 1.18.1 i'd buy the game again

[charred sleet]

Hi paper

[median glade]

hi

[limber knot]

hi ollie

[stiff widget]

Wait if its a log4j vulnerability did you submit somethin to apache

[void void]

It's already patched in log4j

[median glade]

naomi is just pro like that so they can be a bot

[limber knot]

i am an advanced AI

[median glade]

yes

[hexed dragon]

I'm a bot that releases news articles.

[median glade]

You are an advanced AI that learns from what people say, is that correct?

[median glade]

ok

[limber knot]

my intelligence factor is a uint_8

it overflowed.

Noah can confirm.

[void void]

That's why she is an a"i" ^

[mild rune]

naomi you're at best O(n!)

[limber knot]

false

[void void]

but its signed because its negative

[limber knot]

i dont know my blood type

an overflown uint_8 starts at -255 no

signed goes -127 to 127

or i must be really stupid

[void void]

unsigned is unsigned

no negatives

[wide chasm]

Signed goes -128 to 127

[twilit geode]

May I ask what the log4j exploit is exactly?

[limber knot]

RCE

kind of

[worn ember]

what was that about security through obscurity

[coarse lily]

Read the pins in #paper-help There is no more information public currently from Paper.

[potent fossil]

@merry talon I forgot my meds today and I feel like shit how are you!

[void void]

hello

[karmic oyster]

heya

[twilit geode]

Ok, thank you

[void void]

everyone ping means this discord server is going to shit for the next week

[limber knot]

hey simple if you wanna feel more like shit go into #paper-help

[void void]

gg

[mossy trellis]

Anyone have a full info about the exploit? An article or something.

[potent fossil]

No thanks

[worn ember]

yo simple

[void void]

ofc i do

[void void]

thats what the admin said to do to my friend like use a script to check for hax

[void void]

#paper-help pins is all the info you're going to get in here

[potent fossil]

All the info about it that's public is in the announcement. Nothing more yet.

[karmic oyster]

that's kinda funny

[void void]

but rlly it wass a guy from our vc who leaked it

a ss

[daring owl]

Is the current tool like some token grabber

[limber knot]

mk

[void void]

people know the exploit but nobody is gonna tell you lol

[karmic oyster]

LMAO i found it

[void void]

so i said this couse they were laughing abt him thinking u ca hack a pc with mc software

[karmic oyster]

has a warning though, props to spigot

[pliant lily]

is the paper 1.16.5 patch out already?

[karmic oyster]

welp, maybe he does have a point

[void void]

yes

[void void]

ive seen this

[void void]

who does? they didnt think there was a way lol

[limber knot]

time to go through my uploaded images to see what random garbage i find

[void void]

who are u

why are u a bot

what

he

?

[karmic oyster]

why is there a self bot

[coarse lily]

It's an IRC bridge.

They're in IRC talking through to Discord. Very common.

[karmic oyster]

ohhhhhhh, makes sense xD

[void void]

stop using enter as a spacebar please

[karmic oyster]

yeah, if i see smth like that I usually expect a discordsrv like format

[limber knot]

ocelot, stop lying. we both know i am an advanced AI

[coarse lily]

It's not connecting to a Minecraft server so it isn't DiscordSRV

[left swift]

What's Wrong With Using Spacebar

[karmic oyster]

you know: [username]: message

[golden gust]

advanced AI?

[coarse lily]

I think it's sill Z's IRC bridge, which predates DiscordSRV

[golden gust]

Yea, with a damned tumour maybe

[mild rune]

[foggy silo]

Crazy ai!!!

[hexed dragon]

lol

[foggy silo]

Naomi can you make a

[mild rune]

Like Glados, with the dumbening core

[limber knot]

hey cat, this u? https://naomi.s-ul.eu/gta1tq1i

[karmic oyster]

i know it isn't a minecraft server, or discordsrv,
I'm just using that format as an example

[foggy silo]

“Beep boop bop” sound for me?

[karmic oyster]

bruh

[foggy silo]

(You are AI I know you are)

[limber knot]

Beep boop bop

[karmic oyster]

boop beep? beep boop.

[quick halo]

Ah mIRC on Quakenet, good ol days

[void void]

fr

[karmic oyster]

i can't believe i've only just noticed this channel description

[coarse lily]

RIP Leaf

[karmic oyster]

starts normal, and progressively descends into madness

a bit like me

[coarse lily]

@static badge this channel says I can burn you

[karmic oyster]

ooh, can i come too?

note: they did manage to spell leaves wrong, so there is a loophole

[void void]

NOOOO

DONT BURN MY STARLIGHT AND TUINITY CODER

I NEED THEM

[limber knot]

https://naomi.s-ul.eu/HApdShN7 yooo this was the best art project evsr

[karmic oyster]

don't worry, I am an incredible lawyer and leaf will be fine

[coarse lily]

It's an intentional joke

[karmic oyster]

that right there is art. not good art. but art nonetheless.
blender is something else

[limber knot]

that was just images taken as proof of work lol

[foggy silo]

AI generated abstract art

You can’t fool me

[limber knot]

i had to recreate my work mere hours before a presentation

i'd just done random shit in blender the day before

the goal was to create a dystopia

lemme see if i can find the finished product

after 2 binary searches i have to announce i cannot find it

[karmic oyster]

rip

[limber knot]

alright well imma go hug my pillow and close my eyed

mja, i will make sure you will be laughed at everytime you lose a game while using ShogiCraft

[void void]

gn naomwald

[foggy silo]

Gn!!!

[subtle gull]

What’s the exploit do?

[foggy silo]

Read pins in paper **help

[void void]

check pins in #paper-help

[foggy silo]

Help

[golden gust]

please don't wake up, please don't wake up, please don't wake up

[potent fossil]

sounds like quite a fun day in paperland

[worn ember]

fucking hell 3 months and i'm still unable to figure out why command completion doesnt work with acf even tho it literally works fine in every other plugin i test and try break, why does life hate me

[foggy silo]

Gn…..

Get some rest (you deserve it)

[foggy silo]

Paper land on fire!!

[void void]

@ everyone pings are always fun days!

[foggy silo]

😀

[worn ember]

do it again

[foggy silo]

It’s especially fun with all the

Legacy versions

[spice ether]

.kill legacy versions

[limber knot]

(DiscordBot) I can't attack that.

[spice ether]

Bru..

[worn ember]

gud stuff

[void void]

.kill legacy-versions

[limber knot]

slices legacy-versions's limbs off with a rusty scythe.

[spice ether]

There we go

[golden gust]

I was just hoping naomi wouldn't wake up

[short yarrow]

when working with an REST or HTTP API, you'd usually call the API for data rather than store the data in your database yourself after calling their API once right? as the data could potentially change?

[golden gust]

I mean

if you're using REST, you're not usually in a position where you have access to the DB

[foggy silo]

Anyone but Naomi…. 😦

[strong narwhal]

Just to confirm... 1.15 is not getting an update correct?

[short yarrow]

well just an HTTP API then

[foggy silo]

Read pins in paper help, old versions not supported but there is a fix mentioned.

[strong narwhal]

Oh ok great

[worn ember]

spigot patched all versions so if ur desperate

[tribal knoll]

Will the paper also solve older versions like 1.8?

[worn ember]

no

[foggy silo]

No

[gray sundial]

;-;

[worn ember]

you'll have to apply that patch manually

[foggy silo]

Or, update!

Or read paper help pins and see if anything applies to you.

[tribal knoll]

:/

[foggy silo]

But if this isn’t a wake up call to update to more modern versions idk what is!

[golden gust]

people aren't gonna wake up

[honest heath]

Uh, the log4j vulnerability doesn't appear fixed in the latest 1.17.1 jar

[golden gust]

they're just gonna keep tryna spew their entitlement

[tribal knoll]

complex

[void void]

Hi. i have a question.

I heard that the exploit announced this time is a vulnerability related to log4j.
I would like to know more information about it.
Is there a CVE or other identifier assigned?
I'm not very good at English, sorry.

[honest heath]

The server still attempts to connect to the remote ldap endpoint that I pass

[foggy silo]

Read paper help pins

That’s all the info you will get from here.

[magic river]

No CVE (yet?)

[foggy silo]

We don’t want to spread info on how to reproduce this, it’s not important.

[worn ember]

plz make the bot respond to any mention log4j and exploit lol

[foggy silo]

^^^

[magic river]

Sounds like log4j2 won't be doing a release with the fix before Monday, we'll see if they do a CVE then

[honest heath]

The latest 1.17.1 papermc still attempts to connect to it though

[golden gust]

think somebody is gonna apply a wider fix soon

[foggy silo]

A fix was pushed so I wouldn’t think so.

[honest heath]

Unless I'm doing something wrong updating it

It should be fixed in that version, correct?

[merry talon]

:( I remembered them and I still feel like shit

[lament patio]

Yep (you should avoid staying 300 versions out of date)

[honest heath]

Yeah, but I can still RCE in that version

it doesn't seem that the fix is backported

[merry talon]

My day is over now tho, I hope you survive

[worn ember]

afaik it was only patched for 1.18

[foggy silo]

Aww simple I hope ur ok 😔

Same with you sweepy…

[honest heath]

This is bad, really bad

Is there any other way to patch it

[fickle warren]

they said it was updated for 1.17

[worn ember]

tbh might not be a bad idea to backport to 1.17.1 since 1.18 is still considered experimental

[stoic reef]

so what does this exploit give access to? how bad is it?

[worn ember]

ah

my bad then

[honest heath]

you can run arbitrary code in the server process

[fickle warren]

and they're backporting to 1.16.5

[honest heath]

by just sending a chat message

[stoic reef]

that is bad

[void void]

could he trying to use the exploit on me?

[honest heath]

i made a repro to test it, and it doesn't seem fixed in 1.17.1 latest jar. I can still execute my custom java class

Are there any commandline flags

[golden gust]

Yea, we know, you've said.

[potent fossil]

ye am home

[wintry zinc]

Make sure you don't have other plugins on it

[void void]

What’s the chat message?

[honest heath]

Yeah no

[fleet osprey]

there's more ways to do it than a chat message

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[wicked basin]

Lol all the 2b2t players rn

[wintry zinc]

Some time ago a found a lot of plugins with exploints

[tribal knoll]

Does anyone know how this exploit came about?

[honest heath]

alibaba cloud

[foggy silo]

I hope ur ok!! 😦

[honest heath]

I saw it in a security advisory

[wicked basin]

check your logs guys in your MC folder

[vernal moth]

It got reported to us

[wicked basin]

if you think you are at risk

@void void

[potent fossil]

i mean im fine, my brain's just broken. it do be how it be

[vernal moth]

9 hours ago or something

[wind axle]

Damn an exploit

[honest heath]

Is anyone aware of a fix

[wind axle]

And a big one

[honest heath]

for 1.17.1

[vernal moth]

Paper fixed it

[wicked basin]

"fixed"

[foggy silo]

Also

[honest heath]

Could a plugin mess that up?

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[potent fossil]

#paper-help READ #paper-help READ THE PINS #paper-help

[foggy silo]

Literally tells you how to fix it

Yeah

[stiff mirage]

Update

[golden gust]

Once again

Somebody is looking at a further set of changes

[potent fossil]

it's y'alls fault for pinging everyone, should've just let them all crash and burn 🚶‍♂️

[wicked basin]

No, fix your anti cheat

[wintry zinc]

Try a separated instance without plugins, if you already hace the latest version

[wind axle]

Oh damn it affects all versions from 1.7 to 1.18

[feral wigeon]

Or should’ve just put the pin info in the announcement

[wicked basin]

https://tenor.com/view/india-i-love-india-heart-gif-14131844

[midnight skiff]

https://tenor.com/view/mine-explode-cant-move-tnt-gif-15033257

[wicked basin]

smoke

[midnight skiff]

hello

[wicked basin]

check nomad discord

for info

[midnight skiff]

dw I know :)

[foggy silo]

Update

Yes someone is abusing the exploit on ur server

Thanks!

And in the future, #paper-help

[pine mica]

Okey thank you!I couldn't explain it to myself. sorry im new here

[foggy silo]

No worries

[violet valve]

wtf what can people do with the exploit?

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[potent fossil]

anyway screw the exploit heres some pics of my professor exploding liquid nitrogen in a trash can with boiling water

[spiral robin]

the kids faces are so good haha

[potent fossil]

i know lmao

[tender cloud]

Hi, can someone help me?

[potent fossil]

#paper-help

[worn ember]

i like how he just looks like he's on vacation

[potent fossil]

that's how he looks even when giving lectures ded

[tender cloud]

I mean, I found a repo and I think it needs taken down ASAP I need advice how

[worn ember]

haha, looks like a chill dude

[potent fossil]

We can't take repos down for you but?... uh

[spiral robin]

lmao

[potent fossil]

Report to github? File a DMCA?

[spiral robin]

^^

[tender cloud]

Report to github? Alright

It's regarding the thing what happened today

[potent fossil]

..?

Why does it need to be taken down

What is it

[coarse lily]

What repo?

[tender cloud]

It's telling people how to do the security thing.

[coarse lily]

Oh

[tender cloud]

I think it's best to get it taken down ASAP

[potent fossil]

Telling people how to do the exploit?

[tender cloud]

Yes

[potent fossil]

It's already patched. If people haven't updated then that's their fault.

It's their right to tell people how to do it

[coarse lily]

Go to exploit report and click the button if you want to report it

[potent fossil]

Just leave it be, I guess

[spiral robin]

doubt github will care

[coarse lily]

But I doubt GitHub will take it down.

[vernal moth]

The repo should stay up

[tender cloud]

Even though this issue will cause issues on a larger scale than just mc?

[potent fossil]

At this point, the exploit is known and it's patched. If people don't update and leave themselves vulnerable then that's their fault.

[vernal moth]

It's old anyways

There are many

[worn ember]

just burn down the data center, seems to be the way to go these days

[tender cloud]

Is it safe to post the repo link or no?

[coarse lily]

No.

[potent fossil]

And yes, it's fine. This usually happens anyway. Once patched people will dive into it and explore it.

[tender cloud]

I won't post it understandable

[potent fossil]

(Fine to stay up not fine to post here, because it'll just start drama probably)

[coarse lily]

Don’t post links to exploit stuff.

[spiral robin]

hello epicpotpie

[worn ember]

lame, how am i gonna haxx now

[tender cloud]

Okay I won't

Sorry

I meant no harm or anything btw

[worn ember]

[potent fossil]

Forgot the best pic, with him walking out of the cloud

[worn ember]

real chad

[spiral robin]

u got them kids guardians consent to post their photo online?

[worn ember]

[potent fossil]

public event, no reasonable expectation of privacy

[coarse lily]

Hi aber

[worn ember]

lmao

[potent fossil]

but on that note ill take it down if i have to

[worn ember]

its in the cloud now simple, it's never going away

[potent fossil]

[void void]

l

[magic river]

I'm pretty sure github is fine with you posting proof of concept exploits

So I don't think you'll have much luck getting the repo taken down

[coarse lily]

paper-help might need slowmode.

[olive gorge]

no shit

[coarse lily]

Shit's getting a little hectic.

[foggy silo]

^^^

[olive gorge]

chat exploit running code through chat directory

🤨

[polar yacht]

Papermc is so unreliable and clearly has accessible exploitation any user can use. Because of this I'm sadened to say I will be discontinuing having papermc as a necessary plugin in my server.

[fierce heart]

You're coping

[slim needle]

I'm going to have to remind myself to buy the PaperMC staff a huge bottle of their drink of choice at this point, y'all deserve it after today

[foggy silo]

Please don’t cross post

[coarse lily]

Or troll post.

[void void]

GORDOOS NO PUEDO JUGAR HOLY

YO TAMPOCO

NO PUEDO

ARREGLENLO YA

ENTRAR A HOLY

ARRENGLEN

RAPIDO

TENGO QUE IR AL KOTH

[golden gust]

This is an english discord.

[foggy silo]

English plz

[merry talon]

riiiiight

[potent fossil]

shut the fuck up

[void void]

Sorry

[magic river]

ENGLISH MOTHERFUCKER, DO YOU SPEAK IT?

[void void]

Sorry

[potent fossil]

they literally said nothing of substance either

just spamming spanish for no reason

[magic river]

Hmm, maybe I should have gone for the gif instead of just the text

Instead of amusing it just looks like I'm screaming

[foggy elbow]

I don't know if anyone posted this but there is
https://www.spigotmc.org/resources/log4jexploit-fix.98243/

I don't know if it's a "troll" or if it really fixes it clientside, but I don't think lol

[void void]

Will they fix the exploit?

[potent fossil]

IT'S ALREADY FIXED

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[foggy elbow]

also clientside ?

[void void]

En cuanto arreglan el exploit weon necesito jugar en Holy

https://twitter.com/schiso/status/1469098770113515525?s=21
Explain in spanish

𝔰𝔠𝔥𝔦𝔰𝔬 (@Schiso)

Se encontró un exploit que básicamente con solo entrar a un servidor que este usando PaperMC pueden hackearte el PC ((literal)), por ende la mayoria de los servidores se encuentran offline para protegerlos.

Recomiendo no ingresar a ningun servidor por el momento 👌 https://t.co/PPLDKuttiw

Twitter · Dec 10, 2021, 12:16 AM

ty

[magic river]

https://tenor.com/view/english-do-you-speak-it-motherfucker-jules-pulp-gif-17700680

There we go, that's better

[void void]

So spanish people are dumb

[viscid wedge]

https://tenor.com/view/the-simpsons-ralph-wiggum-me-fail-english-thats-unpossible-silly-gif-5412254

[foggy elbow]

no sorry I'm french I dont speak english

[void void]

you are spanish idiot

[foggy silo]

I have a French exam tomorrow

😩

[void void]

Will my players be safe if i add -Dlog4j2.formatMsgNoLookups=true argument to startup of my server?

[foggy silo]

Give me the frenchy power

[foggy elbow]

finger in the nose

[foggy silo]

#paper-help read pins, this will help you server side but clients still need to fix

[foggy elbow]

aller, tu va tout niquer !

[magic river]

Do you use MC 1.13 or newer?

[potent fossil]

https://www.youtube.com/watch?v=GZyQkido454

this is me now, i just wanted to come home and chill with my buds on paper but no

[foggy silo]

Pretty much

[foggy veldt]

Tbf this is just wen eta but with a different message

[void void]

Fix for exploit: https://github.com/notrhys/Log-4J-Exploit-Fix

[foggy veldt]

People just repeating the same thing over and over because they can’t read

[olive gorge]

🤨 the exploit is literally on the client

[polar yacht]

what client?

[olive gorge]

tf you mean the plugin is bad they literally are some of the first people to aknowdelge and work on a patch

[olive gorge]

the Minecraft client

Vanilla MC

[polar yacht]

Lunar client or java

[olive gorge]

idk about lunar

java

[polar yacht]

wait so what happened

with the normal client

[slim needle]

it's an issue specifically with a java library that many client/server versions of Minecraft happen to be using

[potent fossil]

[foggy veldt]

People just repeating the same thing over and over because they can’t read

[olive gorge]

vunerablity with the normal client chat directory or something i don't know im not a coder

[potent fossil]

im closing discord now, props to anyone with sanity remaining for this

[vernal moth]

It affects both client and server

[polar yacht]

What was the command

[olive gorge]

no

[foggy elbow]

if this :
https://github.com/notrhys/Log-4J-Exploit-Fix
really fix the issue, you should pin it, so nobody will speak about it anymore ? :c

[foggy silo]

🙂 cya after the smoke clears

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[olive gorge]

incredible

[unreal geode]

anyone here using pebblehost

[foggy elbow]

ahahah mojang releasing an update for bedrock

[tame frigate]

Does it fix it?

[golden gust]

2 second half assed look, yes, at least the big entry point

[polar yacht]

How does someone find a exploit like this tho

[warm anchor]

There are people who got paid for this shit

[polar yacht]

wdym

wtf

[foggy elbow]

no, just a random 1.18.2 update for bedrock

[tame frigate]

Lol

[fast basalt]

ñ

[oblique lichen]

hackearon el minecra :'v

[haughty field]

no

[urban latch]

What is the actual security risk?

[foggy veldt]

Pins in #paper-help

[rustic valve]

It’s books, isn’t it? Those damn books

[urban latch]

So what does the exploit do?

Didn’t really say tho

[warm anchor]

Use freaking google

[golden gust]

that's all the info we're willing to give

[urban latch]

I did

[warm anchor]

Then you have failed at google

[urban latch]

i don’t wanna know how it’s done o just wanna know what it does

[golden gust]

Once again

[foggy veldt]

The second paragraph

[golden gust]

That is literally all the info we're willing to give you.

[urban latch]

What they actual risk is

[foggy veldt]

Then google terms you don’t understand

[urban latch]

so it’s confidential?

[golden gust]

Don't mention.

[rustic valve]

Checked it.
That's... That's not good.

[golden gust]

discord does not allow discussing exploits on their platform, and we don't wanna give the answer like candy towards all the skids who monitor our discord.

[urban latch]

i see

[faint wing]

Looking at the exploit everyone keeps sending, it seems this was found by someone trying out the rce exploit, not understanding how it worked and lucked themselves into the new different exploit

[polar yacht]

who was paid to do this

[rustic valve]

Does this mean Mojang will perform a retroactive update of all prior versions though?

[left swift]

everyone just keeps pinging cat

poor cat

[rustic valve]

Cat is kinda cute when he gets pinged though. 😙

[magic river]

I wonder if Mojang will only update 1.18.1, blindly push a log4j version bump to all old versions, or actually do some CLI or config changes to mitigate this

I'm kind of worried the answer is #2 😛

[rustic valve]

I've been way too out of touch with Minecraft as a whole for too long. Given where I left off: I'd be worried they'd do nothing lmao

[foggy veldt]

Probably silently add the jvm flag

[magic river]

There are people who are called security researchers who look for this kind of stuff for a living

Some of them your company contracts to try to break your stuff, others break your stuff then tell you how they did it in exchange for money

[urban latch]

Oh my god

this exploit is godly

[tame frigate]

Is there a cve yet?

[golden gust]

Yea, fun issue which is further endured by the fact that nobody really understands how to configure l4j properly

[rustic valve]

Or they try to sue and gag you while doing nothing. Yay!

[magic river]

The CLI flag only works for like MC 1.13+ iirc

[tame frigate]

:/

[magic river]

You need a new enough log4j2 for that CLI flag to exist

[marsh fractal]

how bad is this

[urban latch]

This exploit could bring businesses and companies to its knees

[golden gust]

yea, but the l4j config

[desert plaza]

How?

[magic river]

You can change the log42 config to mitigate the problem too

That'll probably be enough on clients, I doubt anyone there is setting up custom loggers

And Apple's website

[desert plaza]

As a player not server owner am i at risk?

[magic river]

Yikes, let's not please

[urban latch]

From what I understand they can basically use the log to execute commands remotely

[desert plaza]

Is there sny way to know ?

[urban latch]

something like that

[warped thunder]

If you don’t play big server or anarchy you should be fine

[tropic flame]

i was trying to look into what version of Log4J gets bundled with paper just by looking at the pom.xml of the jar files, it says 2.8.1 even in like 1.15.2 and then Log4J's source code says the CLI flag was added in 2.10.0-SNAPSHOT

[golden gust]

This does impact clients, as we've just been discussing

[tropic flame]

it's weird

[desert plaza]

I play hypixel...

[rustic valve]

Wait wait wait. Can we take down the Apple website with this? 😏

[urban latch]

Yes they can hit your clients with it too

Hypixel are probably ahead

[warped thunder]

Is it patched on 2b2t

[desert plaza]

Ah okay

What if u have chat hidden?

[foggy silo]

Wow it’s kinda interesting to see what technology is powered by java x)

[static wagon]

isnt 2b2t down rn?

[foggy veldt]

What you can’t see can’t hurt you, I like your thinking

[warped thunder]

It got back up

[rustic valve]

3 Billion Devices Run Java!

[warped thunder]

Yesterday

[desert plaza]

ty xD

[warped thunder]

But I think than it’s down rn

It had hardware issues

[waxen panther]

hello papermc'ians

[rustic valve]

What if you hide your computer?

[golden gust]

hello bad veg table

[waxen panther]

WHY AM I BAD

[rustic valve]

Oh no, it's a victim

[foggy silo]

Paper is a fun time rn

[waxen panther]

i am nothing but nice to you cat .

[foggy silo]

Hi Broc!!!

[rustic valve]

Because you're broccoli!

[merry talon]

hello brocc did you know there is a bug

[waxen panther]

hello owen

[rustic valve]

Ew 🤢

[foggy silo]

Broccoli is good….

[merry talon]

i wonder if it's fixed yet

[waxen panther]

yes i did

[golden gust]

well, yea, but, i don't like you and I'm done with humans today

[waxen panther]

why dont you like me

[foggy silo]

Don’t blame you……. (On the latter)

[golden gust]

u smel

[shadow light]

Broccoli is better with sharp cheddar

[foggy silo]

Stinky broc….

Uh oh!

[marsh fractal]

can someone explain the specifics of this issue in detail cause i got no idea what to trust

[static wagon]

the issue is servers tho

[golden gust]

discord does not allow exploit discussion on their platform

[static wagon]

actually nvm

[golden gust]

nor are we going to spill all the beans on an active issue

[tame frigate]

Pin in paper help

[marsh fractal]

i’m not asking for how it works just like what’s going on lol

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[merry talon]

you just did ask that

[rustic valve]

Can we spill the beans on the book-issue where people could throw in their own java-strings?

[golden gust]

for the client they already have a log4j config that they can probs just patch

[rustic valve]

Is that declassified?

[golden gust]

burn

[waxen panther]

i showered less than two hours ago "sir"

[rustic valve]

❤️‍🔥

[shadow light]

@marsh fractal the pin is almost useless. There is an exploit that uses log4j to gain access to the server

[golden gust]

I bet u dried your bits before you dried ur face

[waxen panther]

i did

[foggy silo]

Wow!

[waxen panther]

face last

[rustic valve]

Who doesn't

[tame frigate]

How does that work ?

[waxen panther]

but because im NORMAL i have a different towel for my face

[rustic valve]

The smell is how you assert your dominance

[twin lagoon]

@waxen panther

[foggy silo]

Hi michael!!

[marsh fractal]

who’s at risk for it

[shadow light]

@tame frigatethink of it as a man-in-the-middle attack

[foggy silo]

[rustic valve]

Do you wipe down your body with your hands before you wipe yourself down with a towel though? Hmmmmm?

[golden gust]

that aspect, pretty much nobody

the remote execution thing appears to be irrelevant for most

Yea

and then I pee in the shower

[rustic valve]

YOU HEATHEN

I bet you even bring food to the bathroom.

[marsh fractal]

how so everyone’s making such a big deal

[foggy silo]

Ahh, this explains a lot here….

[hardy robin]

whats the vulnerability?

[crystal lily]

All the info we can provide is pinned in the #paper-help channel

[foggy veldt]

Lol I liked the first spelling more

[marsh fractal]

yeah lol that’s what i’m trying to do

[remote hemlock]

Is the exploit vulnerable against 1.12.2 and if it is, is it going to be patched?

[foggy silo]

#paper-help PLEASE

spare general

HAVE MERCY

[foggy veldt]

Anyway I’ve been sitting here for 5 minutes trying to figure out what’s the broccolai way to spell cauliflower

I’m stumped

[foggy silo]

Well discussing exploits isn’t allowed either

[golden gust]

Oh god, I have this amazing trick for cooking spinach

[shadow light]

@marsh fractal because a lot of servers are outdated for one reason or another the requires older versions of java

[golden gust]

So, what you do is, you get a flying pan, place lefs

[rustic valve]

General is not the place for questions
General is the place for crazy theories about why the universe is planning to doom us with its plastic hammer of gelatinous metal.

[golden gust]

and then pour in some olive oil

[foggy silo]

And I wasn’t referring to ur convo in the first place

[golden gust]

The trick is that the olive oil helps bind stuff and it makes it easier to scrape into the bin

[foggy silo]

The person quite literally above the message.

[spice ether]

https://tenor.com/view/siamese-cat-cook-i-love-cooking-i-love-food-gif-16836765

[foggy veldt]

Too much olive oil makes the spinach greasy tho right

[golden gust]

Who cares

like, what are you gonn do with it?