[16:32:01] [Server thread/ERROR]: [Log4JExploitFix] Unhandled exception number 256 occurred in onPacketSending(PacketEvent) for Log4JExploitFix
java.lang.IndexOutOfBoundsException: Index 0 out of bounds for length 0
at jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:64) ~[?:?]
at jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:70) ~[?:?]
at jdk.internal.util.Preconditions.checkIndex(Preconditions.java:266) ~[?:?]
at java.util.Objects.checkIndex(Objects.java:359) ~[?:?]
at java.util.ArrayList.get(ArrayList.java:427) ~[?:?]
at dev.luzifer.log4jexploitfix.Log4JExploitFix$1.onPacketSending(Log4JExploitFix.java:52) ~[Log4JExploitFix-1.3.3.jar:?]
at com.comphenix.protocol.injector.SortedPacketListenerList.invokeSendingListener(SortedPacketListenerList.java:195) ~[ProtocolLib (3).jar:?]
at com.comphenix.protocol.injector.SortedPacketListenerList.invokePacketSending(SortedPacketListenerList.java:149) ~[ProtocolLib (3).jar:?]
at com.comphenix.protocol.injector.PacketFilterManager.postPacketToListeners(PacketFilterManager.java:547) ~[ProtocolLib (3).jar:?]
at com.comphenix.protocol.injector.PacketFilterManager.invokePacketSending(PacketFilterManager.java:521) ~[ProtocolLib (3).jar:?]
at com.comphenix.protocol.injector.netty.manager.NetworkManagerInjector.onPacketSending(NetworkManagerInjector.java:99) ~[ProtocolLib (3).jar:?]
at com.comphenix.protocol.injector.netty.channel.NettyChannelInjector.processOutbound(NettyChannelInjector.java:570) ~[ProtocolLib (3).jar:?]
at com.comphenix.protocol.injector.netty.channel.NettyChannelInjector$2.proxyRunnable(NettyChannelInjector.java:473) ~[ProtocolLib (3).jar:?]
at com.comphenix.protocol.injector.netty.channel.NettyEventLoopProxy.execute(NettyEventLoopProxy.java:220) ~[ProtocolLib (3).jar:?]
at net.minecraft.network.Connection.sendPacket(Connection.java:433) ~[?:?]
at net.minecraft.network.Connection.send(Connection.java:380) ~[?:?]
at net.minecraft.server.network.ServerGamePacketListenerImpl.send(ServerGamePacketListenerImpl.java:2165) ~[?:?]
at net.minecraft.server.network.ServerGamePacketListenerImpl.send(ServerGamePacketListenerImpl.java:2151) ~[?:?]
at com.comphenix.protocol.reflect.accessors.DefaultMethodAccessor.invoke(DefaultMethodAccessor.java:23) ~[ProtocolLib (3).jar:?]
at com.comphenix.protocol.injector.netty.channel.NettyChannelInjector.sendServerPacket(NettyChannelInjector.java:293) ~[ProtocolLib (3).jar:?]
at com.comphenix.protocol.injector.netty.channel.NettyChannelInjector.lambda$processOutbound$5(NettyChannelInjector.java:564) ~[ProtocolLib (3).jar:?]
at org.bukkit.craftbukkit.v1_19_R1.scheduler.CraftTask.run(CraftTask.java:101) ~[paper-1.19.2.jar:git-Paper-278]
at org.bukkit.craftbukkit.v1_19_R1.scheduler.CraftScheduler.mainThreadHeartbeat(CraftScheduler.java:483) ~[paper-1.19.2.jar:git-Paper-278]
at net.minecraft.server.MinecraftServer.tickChildren(MinecraftServer.java:1473) ~[paper-1.19.2.jar:git-Paper-278]
at net.minecraft.server.dedicated.DedicatedServer.tickChildren(DedicatedServer.java:446) ~[paper-1.19.2.jar:git-Paper-278]
at net.minecraft.server.MinecraftServer.tickServer(MinecraftServer.java:1397) ~[paper-1.19.2.jar:git-Paper-278]
at net.minecraft.server.MinecraftServer.runServer(MinecraftServer.java:1173) ~[paper-1.19.2.jar:git-Paper-278]
at net.minecraft.server.MinecraftServer.lambda$spin$0(MinecraftServer.java:305) ~[paper-1.19.2.jar:git-Paper-278]
at java.lang.Thread.run(Thread.java:833) ~[?:?]
The best plugin against the Log4j exploit! It reliably protects the players from malicious messages and comes with an additional "protected" logger. - This is particularly good for analyzing the bad messages. - The author is friendly and constantly updates the plugin, so you can assume that you will be well equipped against this exploit in the future, too. :)
This plugin is very good. The plugin does not completely patch the exploit but it blocks hackers from hacking other players. I would recommend this on your server to protect your players!
Not sure why people are giving it 1 star because it isn't bypassing any checks I tried.
I tried the following attacks on 1.8 to see if anything would be logged and they were all removed as message:
- Log in with a cracked account with the URL as name -> Name 24>16 and not logged. it's impossible to fit the evil URL as name while not breaking the 15 character limits.
- Simply say the message, message didn't show up, gave a warning I tried to break the server.
- Rename item to message, kill message didn't show up and wasn't logged, so worked good as well.
- Rename mob to message, when player gets killed by mob, the message also gets removed.
If there's any way to bypass it I'd change my rating but for now it doesn't seem to allow any logging to go through.
This plugin does not patch the exploit fully, there are several ways to bypass the exploit, both on the server side and on the client side. DO NOT USE THIS PLUGIN.
as i can see you found the way from papermc-discord, where you jumped on me and stated this plugin AND its functionality as very dangerous and malicious, to my resource page where you now... do the same?
Why are you saying everywhere that people should not protect themselves sufficiently from the exploit using an additional plugin besides the updates?
Nowhere it states that it will 100% fix anything, it just blocks the execution of the exploit. The exploit is still there if you dont update.
The integrated filter system filters the logs which, would've been produced by Log4J in the next moment, for the malicious strings. If it found any, it will cancel the logging. To protect the player clients it blocks the spreading of the exploit over the chat at protocol-level which would cause getting the message logged clientside. Just for your information.
read the description again. server, and *client*side. the plugin blocks the message so it doesn't get logged for both sides. the fixes of spigot or paper are just serverside
Version: 2021-12-10
This does not fully fix the issue. Some examples of when this could still affect the server:
- If a user were to include the text in a command. (Including to another player like /msg)
This only prevents the player from typing into chat when it needs to prevent it in many many more scenarios.
Plug-in is very good, thank you for sharing, I found a few BUG, private chat players can still lead to card suits, hope repair, thank you for your selfless dedication
Başarılı eklenti. Böyle bir eklentiyi hızlı ve ücretsiz olarak sağladığın için çok teşekkürler. Gördüğüm kadarıyla emeğinin karşılığını alamıyorsun. Umarım bir gün yaptığın işin karşılığını alırsın.
Successful plugin. Thank you very much for providing such an add-on quickly and for free. As far as I can see, you're not getting paid for your work. I hope one day your work will be rewarded.