Full Report
We recap our December 2021 episode of Tradecraft Tuesday where we dive into the Log4Shell vulnerability.
Analysis Summary
# Vulnerability: Log4Shell Remote Code Execution
## CVE Details
* **CVE ID:** CVE-2021-44228 (Primary), CVE-2021-45046, CVE-2021-45105, CVE-2021-44832
* **CVSS Score:** 10.0 (Critical)
* **CWE:** CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement) / CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
* **Products:** Any software utilizing the Apache Log4j 2 logging library. Notable examples include Apple, Amazon, Cisco, Tesla, Minecraft, FileZilla FTP, and thousands of other enterprise applications and cloud services.
* **Versions:** Log4j versions 2.0-beta9 to 2.14.1. (Note: Additional vulnerabilities were later found in 2.15 and 2.16).
* **Configurations:** Systems where Log4j processes user-controlled input (e.g., login forms, search bars, user agents, or HTTP headers) and has outbound network access.
## Vulnerability Description
The flaw exists in how Log4j handles log messages containing a specific syntax related to the **Java Naming and Directory Interface (JNDI)**. When Log4j encounters a string like `${jndi:protocol://server/path}`, it attempts to resolve this variable by reaching out to the specified server.
Attackers can use the **Lightweight Directory Access Protocol (LDAP)** to point the vulnerable application to a malicious server. The application then downloads and executes a malicious Java class file, leading to full **Remote Code Execution (RCE)**.
## Exploitation
* **Status:** Exploited in the wild; multiple PoCs widely available.
* **Complexity:** Low (Requires only a single crafted string).
* **Attack Vector:** Network (Remote).
## Impact
* **Confidentiality:** Total (Attacker can steal data and credentials).
* **Integrity:** Total (Attacker can execute arbitrary code and modify systems).
* **Availability:** Total (Attacker can deploy ransomware or crash the service).
## Remediation
### Patches
* **For Java 8 or later:** Upgrade to **Log4j 2.17.1** or higher.
* **For Java 7:** Upgrade to **Log4j 2.12.4**.
* **For Java 6:** Upgrade to **Log4j 2.3.2**.
### Workarounds
* **Disable JNDI Lookups:** In versions 2.10 to 2.14.1, set the system property `log4j2.formatMsgNoLookups` or the environment variable `LOG4J_FORMAT_MSG_NO_LOOKUPS` to `true`.
* **Remove the Class:** Manually remove the `JndiLookup.class` file from the `log4j-core` JAR file.
* **Egress Filtering:** Block outbound LDAP/RMI traffic from application servers to unknown internet destinations.
## Detection
* **Indicators of Compromise (IoC):** Look for `${jndi:ldap://...}` or obfuscated variations (e.g., `${jndi:${lower:l}${lower:d}ap://...}`) in web server access logs and application logs.
* **Detection Tools:**
* **Huntress Log4Shell Tester:** An open-source tool to test if inputs trigger an LDAP callback.
* **NCSC-NL Scanner:** A comprehensive list of scanners and detection scripts available on GitHub.
* **YARA Rules:** Use community YARA rules to scan for the presence of vulnerable JAR files on disk.
## References
* Apache Security Advisory: [https://logging.apache.org/log4j/2.x/security.html](https://logging.apache.org/log4j/2.x/security.html)
* Huntress Blog Analysis: [https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java](https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java)
* NCSC-NL Repository: [https://github.com/NCSC-NL/log4shell](https://github.com/NCSC-NL/log4shell)