Log4j is developed by the Apache Foundation and is widely used by many enterprise applications and cloud services .Recently a zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) has been made public on December 9, 2021 by some security researchers .
This critical zero-day vulnerability in Apache Log4j Java-based logging library has exposed many enterprises to ongoing remote code execution attacks. Many Web Servers around the globe are getting massive hits .
Mass scanning activity detected from multiple hosts checking for servers using Apache Log4j (Java logging library) vulnerable to remote code execution (https://t.co/GgksMUlf94).
Query our API for “tags=CVE-2021-44228” for source IP addresses and other IOCs. #threatintel
— Bad Packets (@bad_packets) December 10, 2021
How to Check your Servers
A comprehensive Tenable.io Web App Scanning (WAS) plugin has been released which can be used to test input fields that can be used to exploit Log4Shell.
Severity: Critical
ID: 113075
Type: remote
Log4j is included in a number of web applications and used by a variety of cloud services . A Full list of Services OR Websites will be appearing gradually however if your Web Serves/Applications are using any of the Products given below , most Probably you are Affected .
-
Apache Solr
-
Apache Struts2
-
Apache Druid
-
Apache Flink
-
Apache Spark
-
Apache Tomcat
Remediation
- Anyone using Log4j should update to version 2.15.0 as soon as possible. The latest version can already be found on the Log4j download page.
- If updating to the latest version is not possible the vulnerability can be mitigated by removing the JndiLookup class from the class path by running a command like ( zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class)
- Additionally, the issue can be mitigated on Log4j versions which are less than 2.10 by setting the system property log4j2.formatMsgNoLookups to True
Below is a screenshot of How it can be done on a Windows Serves as some Java Based Applications use Apache Servers as Web Servers .
Go to Control Panel | System and Security | System Advanced System Settings | Environment variables | System Variables and enter a new System Variable LOG4J_FORMAT_MSG_NO_LOOKUPS environment variable to true.
References
Please refer to the below resources for more technical details .
- https://www.tenable.com/blog/cve-2021-44228-proof-of-concept-for-critical-apache-log4j-remote-code-execution-vulnerability
- https://www.tenable.com/plugins/was/113075
- https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228
- https://logging.apache.org/log4j/2.x/security.html
- https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/
