Article

Table of Contents
Theme:
Was this article helpful?
Try Vultr Today with

$50 Free on Us!

Want to contribute?

You could earn up to $600 by adding new articles.

How to Patch Minecraft for the Log4J2 Exploit

Last Updated: Sat, Dec 11, 2021
Minecraft Popular Security

Urgent: Upgrade your Minecraft Servers

Minecraft servers before version 1.18.1 are vulnerable to a Remote Code Execution attack. You must upgrade immediately.

  • If you deploy a new Minecraft server at Vultr, you are protected. Vultr's Minecraft server image has been upgraded to version 1.18.1, which is safeguarded against the exploit.
  • If your server is version 1.18 or earlier, you must upgrade. Please use these instructions.

How to Patch your Minecraft Server

  1. Connect to your server with SSH as root.
  2. Create fix_minecraft.sh in your text editor.

    # nano ~/fix_minecraft.sh
    
  3. Paste the following script:

    #!/bin/bash
    
    echo "Vultr Minecraft Log4j RCE Patcher - v1.0"
    
    if ! [ -z "$(grep "Dlog4j.configurationFile=log4j2.xml" /home/minecraft/minecraft_server.sh)" ]; then
        echo "Already patched!"
        exit 0
    fi
    
    echo "Grabbing version!"
    VERSION="$(cat minecraft_server_version)"
    VERSION_MAJOR="$(echo ${VERSION} | awk -F'.' '{print $1}')"
    VERSION_MINOR="$(echo ${VERSION} | awk -F'.' '{print $2}')"
    echo "Found Version: ${VERSION}"
    
    if [ "${VERSION_MAJOR}" == "1" ] && [ "${VERSION_MINOR}" -lt "12" ]; then
        echo "Found OLD Version: ${VERSION}, using pre 1.12 xml fix!"
        URL="https://launcher.mojang.com/v1/objects/dd2b723346a8dcd48e7f4d245f6bf09e98db9696/log4j2_17-111.xml"
    fi
    
    URL="https://launcher.mojang.com/v1/objects/02937d122c86ce73319ef9975b58896fc1b491d1/log4j2_112-116.xml"
    if [ "${VERSION}" == "1.18.1" ] || [ "${VERSION_MINOR}" -gt "18" ]; then
        echo "Found NEW Version: ${VERSION}, no patch needed!"
        exit 0
    fi
    
    echo "Downloading: ${URL}"
    curl -Ls "${URL}" > /home/minecraft/log4j2.xml
    
    echo "Patching: /home/minecraft/minecraft_server.sh"
    sed -i -e 's/java -Xmx/java -Dlog4j.configurationFile=log4j2.xml -Xmx/g' /home/minecraft/minecraft_server.sh
    
  4. Type CTRL+X, and then Y to save and exit.

  5. Make the script executable.

    # chmod u+x ~/fix_minecraft.sh
    
  6. Run the script.

    # bash ~/fix_minecraft.sh
    
  7. As a precaution, please reboot your server.

More Information

There is a new zero-day exploit for the Log4J2 library used by Minecraft. This exploit allows unsophisticated attackers to take over your server remotely. The vulnerability has been reported with CVE-2021-44228 against the log4j-core jar and is fixed in Log4J v2.15.0.

To protect our network, Vultr may shut down vulnerable Minecraft servers. Please upgrade immediately.

Want to contribute?

You could earn up to $600 by adding new articles.

このウェブサイトの日本語版は情報提供のみを目的とした翻訳であり、英語版が優先されます。