Patchfirst
Patchfirst
CVE-2021-44228 KEVRansomwarePublic exploit Critical · 10.0 EPSS >99.9%

Apache Log4j2 Remote Code Execution Vulnerability

Apache · Log4j2

Summary

The flaw is in the JNDI lookup features of Apache Log4j2 (log4j-core) in versions 2.0-beta9 through 2.15.0, where configuration, log messages, and parameters are not protected against attacker-controlled LDAP and other JNDI endpoints. An attacker who can control log messages or log message parameters can get arbitrary code loaded from LDAP servers and executed when message lookup substitution is enabled.

Official description · NVD

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Breakdown
90.0 / 100
Exploited
Yes, in CISA KEV
Reports
10
Tactics
4/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What can follow

First seen exploited 4 days before it was disclosed. Public exploit code (PoC-in-GitHub) was available 1 day before disclosure.

  1. First seen exploitedVulnCheck KEV evidence4 days before
  2. Public exploit codePoC-in-GitHub1 day before
  3. DisclosedAdded to CISA KEVknown ransomware use; EU database agreesday 0
  4. First dated threat reportresearch.checkpoint.com+32 days

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

See the family tree

A fix was bypassed or incomplete 2 times over 8 months. The latest fix listed for log4j-core is 2.17.1.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2021-44228Log4j2 Remote Code Execution10 Dec 2021KEV
  2. relatedHigh

    Why these are linked:

    CVE-2021-4104Deserialization of untrusted data in JMSAppender in Apache Log4j…14 Dec 2021
  3. same family
    CVE-2021-45046Log4j2 Deserialization of Untrusted Data14 Dec 2021KEV
  4. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textIt was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed.
    CVE-2021-4125It was found that the original fix for log4j CVE-⁠2021-⁠44228 and…24 Aug 2022

Fixes in log4j-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.0CVE-2023-2646410 Mar 2023
  2. 2.8.2CVE-2017-564517 Apr 2017
  3. 2.13.2CVE-2020-948827 Apr 2020
  4. 2.15.0CVE-2021-4422810 Dec 2021KEV
  5. 2.16.0CVE-2021-4504614 Dec 2021KEV
  6. 2.17.0CVE-2021-4510518 Dec 2021
  7. 2.17.1CVE-2021-4483228 Dec 2021Latest listed

techniques

5 , grouped by in kill-chain order 5

Resource DevelopmentTA0042

Upload Malware T1608.001 Medium
MITRE CTID mapping of the KEV entry · follow-on activity

CVE-2021-44228, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework. An actor can exploit this vulnerability by submitting a specially crafted request to a vulnerable system that causes that system to execute arbitrary code. The request allows a cyber actor to take full control over the system. The actor can then steal information, launch ransomware, or conduct other malicious activity.

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
MITRE CTID mapping of the KEV entry · how it is exploited

This remote code execution vulnerability is exploited through maliciously-crafted requests to a web application.

PersistenceTA0003

Web Shell T1505.003 Medium
MITRE CTID mapping of the KEV entry · follow-on activity

ImpactTA0040

Data Encrypted for Impact T1486 Medium
MITRE CTID mapping of the KEV entry · follow-on activity
Resource Hijacking T1496 Medium
MITRE CTID mapping of the KEV entry · follow-on activity

Detection

2 rules for this CVE · 214 general rules for its techniques

Rules for this CVE

2 that reference CVE-2021-44228 directly.

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Web ShellT1505.00335 general rules
All 35 on SigmaHQ ↗
Data Encrypted for ImpactT148617 general rules
All 17 on SigmaHQ ↗
Resource HijackingT149613 general rules
All 13 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

5 packages in 1 ecosystem. Main package: org.apache.logging.log4j:log4j-core.

Mavenorg.apache.logging.log4j:log4j-coreGHSA-jfh8-c2jp-5v3q

Upgrade to 2.17.1 or later

Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2021-44832, CVE-2021-45046, +1).

Set the version to 2.17.1 or later in your pom.xml or build.gradle.

First fixed in 2.15.0 for CVE-2021-44228.

Affected versions, by release line

If you runUpgrade to
2.13.0 up to 2.15.02.17.1first fix for this CVE: 2.15.0
2.4 up to 2.12.22.12.4first fix for this CVE: 2.12.2
2.0-beta9 up to 2.3.1

Still affected on this line by CVE-2017-5645 (fixed in 2.8.2, a newer line).

2.3.2first fix for this CVE: 2.3.1

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (4)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

  • Mavenorg.ops4j.pax.logging:pax-logging-log4j2
    Affected: 2.0.0 up to 2.0.11; 1.11.0 up to 1.11.10; 1.10.0 up to 1.10.8; 1.8.0 up to 1.9.2Upgrade to 2.0.14 or later (older lines: 1.11.13, 1.10.9, 1.9.2)
    GHSA-jfh8-c2jp-5v3q
  • Mavencom.guicedee.services:log4j-core
    Affected: 1.2.1.2-jre17 and earlierNo fixed version published
    GHSA-jfh8-c2jp-5v3q
  • Mavenorg.xbib.elasticsearch:log4j
    Affected versions not listedNo fixed version published
    GHSA-jfh8-c2jp-5v3q
  • Mavenuk.co.nichesolutions.logging.log4j:log4j-core
    Affected versions not listedNo fixed version published
    GHSA-jfh8-c2jp-5v3q

Check your lockfile against all CVEs

What security researchers reported

Named in 10 threat reports
10 reportsMicrosoft2CISA2Check Point+5Jan 2022 – May 2022 · 8 undated

Reports are matched by finding the exact id CVE-2021-44228 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

LinkedInUndated

RaaS AvosLocker Incident Response Analysis

…topology above: vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege…

Original (opens in a new tab) ↗

Show all 10 reportsShow fewer

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

52 links, grouped by NVD tag (51 duplicates merged)

Vendor Advisory 2

logging.apache.org/log4j/2.x/security.htmlmsrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/

Patch 2

oracle.com/security-alerts/cpuapr2022.htmloracle.com/security-alerts/cpujan2022.html

US Government Resource 3

github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.mdkb.cert.org/vuls/id/930724cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228

Third Party Advisory 43

packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlpacketstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.htmlpacketstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.htmlpacketstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlpacketstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.htmlpacketstormsecurity.com/files/165282/Log4j-Payload-Generator.htmlpacketstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.htmlpacketstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
Show 35 moreShow fewerpacketstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.htmlpacketstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.htmlpacketstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.htmlpacketstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.htmlpacketstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.htmlpacketstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlpacketstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.htmlpacketstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.htmlseclists.org/fulldisclosure/2022/Dec/2seclists.org/fulldisclosure/2022/Jul/11seclists.org/fulldisclosure/2022/Mar/23openwall.com/lists/oss-security/2021/12/10/1openwall.com/lists/oss-security/2021/12/10/2openwall.com/lists/oss-security/2021/12/10/3openwall.com/lists/oss-security/2021/12/13/1openwall.com/lists/oss-security/2021/12/13/2openwall.com/lists/oss-security/2021/12/14/4openwall.com/lists/oss-security/2021/12/15/3cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfcert-portal.siemens.com/productcert/pdf/ssa-479842.pdfcert-portal.siemens.com/productcert/pdf/ssa-661247.pdfcert-portal.siemens.com/productcert/pdf/ssa-714170.pdfgithub.com/cisagov/log4j-affected-dbgithub.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228lists.debian.org/debian-lts-announce/2021/12/msg00007.htmlpsirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032security.netapp.com/advisory/ntap-20211210-0007/support.apple.com/kb/HT213189tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdtwitter.com/kurtseifried/status/1469345530182455296bentley.com/en/common-vulnerability-exposure/be-2022-0001debian.org/security/2021/dsa-5020intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.htmlnu11secur1ty.com/2021/12/cve-2021-44228.htmloracle.com/security-alerts/alert-cve-2021-44228.html

Release Notes 2

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
↑ ↓ chooseEnter openEsc close