Log4J Vulnerability¶

Overview¶

On Friday 10th December, Apache announced the discovery of a critical vulnerability in the Log4J logging library for Java, which is used by millions of Java applications and other products and services to log error messages. This vulnerability is known as CVE-2021-44228 or as Log4Shell. Log4J is often installed on both Linux and Windows systems either directly, or often as a requirement of another package or system.

The severity of the vulnerability is based on the ease with which this can be exploited – for example, a malformed username will be logged and can contain code which triggers the exploit. An attacker who can control log messages or log message parameters, can execute arbitrary code when message lookup substitution is enabled.

On Tuesday 14th December, a second vulnerability was identified, CVE-2021-45046, as the original mitigation was incomplete in certain non-default configurations. In certain conditions, attackers could craft malicious input data using a JNDI Lookup pattern resulting in a Denial of Service attack.

On Friday 17th December, CVE-2021-45046 had its severity increased from 3.7 to 9.0 as additional exploits were found against the v2.15.0 release that was intended to resolve these issues.

On Saturday 18th December, CVE-2021-45105 was released after a Denial of Service (DOS) attack was found in all v2.xx releases, including the recent v2.16.0 release. Upgrading to v2.17.x is the recommended mitigation action.

National Cyber Security Centre Guidance¶

The National Cyber Security Centre have released detection and enhanced mitigation advice at the following link.

• National Cyber Security Centre Guidance

UKFast’s Response¶

UKFast is encouraging all clients to validate whether their own applications and environments use Log4J and to upgrade to the latest version where possible, applying the appropriate mitigations where upgrade isn’t an option. For our part, UKFast is currently working through all our systems to be absolutely sure we are protected.

Our Security experts are running scans to identify attempts to exploit the vulnerability. Our support teams are looking at not only updating those products and services managed by UKFast, but are also looking into the wider scope of affected applications, with a view to better informing our clients the best mitigation methods with systems they manage.

Identification¶

bash <(curl -s https://software.ukfast.uk/pub/CVE-2021-44228-Scanner.sh)

Logpresso CVE-2021-44228 Vulnerability Scanner 1.6.2 (2021-12-16)
Scanning directory: /
[*] Found CVE-2021-44228 vulnerability in /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-tcp-5.2.3-java/vendor/jar-dependencies/org/logstash/inputs/logstash-input-tcp/5.2.3/logstash-input-tcp-5.2.3.jar, log4j 2.9.1
[*] Found CVE-2021-45046 vulnerability in /usr/share/logstash/logstash-core/lib/jars/log4j-core-2.15.0.jar, log4j 2.15.0

Scanned 51572 directories and 297467 files
Found 2 vulnerable files
Found 0 potentially vulnerable files
Found 0 mitigated files
Completed in 9.23 seconds

C:\windows\system32>cd C:\Users\test\Desktop

C:\Users\test\Desktop>

log4j2-scan.exe --all-drives

C:\Users\test\Desktop>log4j2-scan.exe --all-drives
Logpresso CVE-2021-44228 Vulnerability Scanner 1.6.3 (2021-12-16)
Scanning drives: C:\,D:\

Running scan (20s): scanned 41420 directories, 246150 files, last visit: C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~19041.1348.1.7\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.19041.1151_none_e0e8a531e34051a9
Running scan (30s): scanned 70477 directories, 338232 files, last visit: C:\Windows\System32\DriverStore\FileRepository\c_barcodescanner.inf_amd64_266a07997c075b30
Running scan (40s): scanned 106185 directories, 411142 files, last visit: C:\Windows\WinSxS\Temp\InFlight\e21ccf73abd5d70114040000203c3005\amd64_microsoft-windows-syncsettings_31bf3856ad364e35_10.0.19041.746_none_696a462e890ee74f\f

Scanned 115116 directories and 436505 files
Found 0 vulnerable files
Found 0 potentially vulnerable files
Found 0 mitigated files
Completed in 42.07 seconds

Affected Versions¶

The Apache project have a security page which contains the latest information.

Mitigations¶

The recommended mitigation is to ensure you are using a patched version of Log4j, which is v2.17.0 or above as of writing. This is likely to be outside of your control if you are relying on software from a vendor. In this case, removing the JndiLookup class from the classpath will mitigate CVE-2021-45046 and CVE-2021-42288 fully in older versions of Log4J:

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

For mitigation against CVE-2021-45105, see the Apache project security page.

Affected Software Information¶