CVE-2023-6378
📋 TL;DR
A serialization vulnerability in logback's receiver component (versions 1.4.11 and earlier) allows attackers to send maliciously crafted data that causes denial-of-service conditions. This affects any application using logback's receiver functionality for remote logging. Systems with exposed logback receivers are vulnerable.
💻 Affected Systems
- logback
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion or crashes from malicious serialization payloads.
Likely Case
Service degradation or temporary unavailability from DoS attacks targeting the logging infrastructure.
If Mitigated
Minimal impact if receivers are not exposed or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires sending malicious data to the logback receiver endpoint. No authentication needed if endpoint is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: logback 1.4.12 or later
Vendor Advisory: https://logback.qos.ch/news.html#1.3.12
Restart Required: Yes
Instructions:
1. Update logback dependency to version 1.4.12 or later. 2. Update pom.xml or build.gradle with new version. 3. Rebuild and redeploy application. 4. Restart affected services.
🔧 Temporary Workarounds
Disable logback receiver
allDisable or restrict access to logback receiver component if not required
Configure logback.xml to disable receiver: <receiver class="ch.qos.logback.classic.net.server.ServerSocketReceiver"> <disabled>true</disabled> </receiver>
Network isolation
linuxRestrict network access to logback receiver ports
iptables -A INPUT -p tcp --dport [logback-port] -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port protocol="tcp" port="[logback-port]" drop'
🧯 If You Can't Patch
- Implement network segmentation to isolate logback receivers from untrusted networks
- Deploy WAF or reverse proxy with input validation rules to filter malicious payloads
🔍 How to Verify
Check if Vulnerable:
Check logback version in dependencies: grep -r "logback.*1\.4\.1[0-1]" pom.xml build.gradleCheck Version:
grep -o "logback.*[0-9]\.[0-9]\.[0-9]\+" pom.xml build.gradle gradle.propertiesVerify Fix Applied:
Verify logback version is 1.4.12 or later: java -cp "logback-classic-*.jar" ch.qos.logback.classic.Logger | grep version📡 Detection & Monitoring
Log Indicators:
- Unusual serialization errors in logback logs
- High volume of malformed logging requests
- Stack traces containing java.io.InvalidClassException
Network Indicators:
- Unusual traffic to logback receiver ports (default 4560)
- Large serialized objects sent to logging endpoints
SIEM Query:
source="*logback*" AND ("InvalidClassException" OR "serialization" OR "receiver")