Find a trigger for log4j2 remote command execution in symphony 3.6.3

[By-Yexing]

In symphony 3.6.3 and earlier, the use of an insecure log4j version resulted in a remote command execution risk. In the course of actual testing, a vulnerability trigger was found:


Vulnerability interface: "/activity/character/submit"


This can eventually cause an attacker to take over the server.

At present, there are still a large number of servers in the public network that have not been upgraded to 3.6.4.

[88250]

Thanks for reporting this issue. We have upgraded the log4j dependency in the latest version.