CRITICAL

CVE-2021-44228

Apache Log4j 2021-12-10 CVSS v3.1

CVSS

10

KEV

Description

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Summary dbcve.org

Apache Log4j2 (log4j-core) versions 2.0-beta9 through 2.15.0 expose JNDI lookup functionality in configuration files, log messages, and message parameters that can be directed to attacker-controlled LDAP or other JNDI endpoints. When message lookup substitution is enabled, an attacker controlling logged data can trigger remote loading and execution of arbitrary code from those endpoints, yielding full remote code execution in the vulnerable JVM process. The flaw is specific to log4j-core and does not affect log4net, log4cxx, or sibling Apache Logging projects.

Mitigation

Upgrade log4j-core to 2.16.0 (or the appropriate 2.12.2 / 2.12.3 / 2.3.1 branch release) where the vulnerable lookup functionality has been completely removed, or at minimum to 2.15.0 where the risky behavior is disabled by default; ensure no 2.0-beta9 through 2.15.0 instances remain in production.

Proof of Concept

Weakness (CWE)

CWE-20 Improper Input Validation

CWE-400 Uncontrolled Resource Consumption

CWE-502 Deserialization of Untrusted Data

CWE-917

EPSS Score

100%

Probability of exploitation in next 30 days

100th percentile

References

http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html Broken Link, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html Third Party Advisory, VDB Entry http://seclists.org/fulldisclosure/2022/Dec/2 Exploit, Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Jul/11 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Mar/23 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/12/10/1 Mailing List, Mitigation, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/12/10/2 Mailing List, Mitigation, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/12/10/3 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/12/13/1 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/12/13/2 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/12/14/4 Mailing List, Third Party Advisory http://www.openwall.com/lists/oss-security/2021/12/15/3 Mailing List, Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf Third Party Advisory https://github.com/cisagov/log4j-affected-db Third Party Advisory https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md Broken Link, Product, US Government Resource https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228 Exploit, Third Party Advisory https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html Mailing List, Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/ Release Notes https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/ Release Notes https://logging.apache.org/log4j/2.x/security.html Release Notes, Vendor Advisory https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Patch, Third Party Advisory, Vendor Advisory https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 Third Party Advisory https://security.netapp.com/advisory/ntap-20211210-0007/ Third Party Advisory https://support.apple.com/kb/HT213189 Third Party Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd Third Party Advisory https://twitter.com/kurtseifried/status/1469345530182455296 Broken Link, Exploit, Third Party Advisory https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001 Third Party Advisory https://www.debian.org/security/2021/dsa-5020 Mailing List, Third Party Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html Third Party Advisory https://www.kb.cert.org/vuls/id/930724 Third Party Advisory, US Government Resource https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html Exploit, Third Party Advisory https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Third Party Advisory https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228 Third Party Advisory, US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.