Full Report
On 2021-12-09, a vulnerability in Apache Log4j (a logging library used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as “Log4Shell”. On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens Energy is preparing updates and recommends specific countermeasures for TraceAlertServerPLUS.
Analysis Summary
# Vulnerability: Apache Log4j RCE and DoS (Log4Shell)
## CVE Details
- **CVE ID:** CVE-2021-44228 (Log4Shell), CVE-2021-45046
- **CVSS Score:**
- CVE-2021-44228: 10.0 (Critical)
- CVE-2021-45046: 9.0 (Critical) - *Reclassified from 3.7*
- **CWE:** CWE-502 (Deserialization of Untrusted Data), CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement)
## Affected Systems
- **Products:** Apache Log4j logging library and downstream Java-based applications (specifically mentioned: Siemens Energy TraceAlertServerPLUS).
- **Versions:** Log4j 2.0-beta9 to 2.15.0.
- **Configurations:**
- **CVE-2021-44228:** Affects default configurations.
- **CVE-2021-45046:** Initially thought to require non-default configurations (Context Lookups), but impacts version 2.15.0 which was previously considered a fix.
## Vulnerability Description
These vulnerabilities involve the Java Naming and Directory Interface (JNDI) features used in Log4j.
- **CVE-2021-44228:** Occurs when an attacker-controlled string is logged, triggering a lookup that allows for unauthenticated Remote Code Execution (RCE) via JNDI references (LDAP, RMI, etc.).
- **CVE-2021-45046:** Discovered after the initial fix (2.15.0) was found to be incomplete. It allows for Denial of Service (DoS), information disclosure, and potential RCE by exploiting specific configurations using non-default Pattern Layouts with a Context Lookup.
## Exploitation
- **Status:** Exploited in the wild; Proof of Concept (PoC) widely available.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full information disclosure)
- **Integrity:** High (Full system compromise)
- **Availability:** High (System crash or resource exhaustion)
## Remediation
### Patches
- **Log4j 2.16.0:** Disables JNDI by default and removes support for message lookups (Recommended for Java 8+).
- **Log4j 2.12.2:** Backported fix for Java 7 users.
- **Siemens Energy:** Users of TraceAlertServerPLUS should monitor for vendor-specific updates currently being prepared.
### Workarounds
- **Configuration:** For versions >=2.10, set the system property `log4j2.formatMsgNoLookups` or the environment variable `LOG4J_FORMAT_MSG_NO_LOOKUPS` to `true`.
- **Modification:** Remove the `JndiLookup` class from the classpath (e.g., `zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class`).
- **Network:** Implement egress filtering to block suspicious outbound connections (LDAP/RMI) from application servers.
## Detection
- **Indicators of compromise:** Look for `${jndi:ldap://...}` or similar patterns (rmi, dns, ldaps) in application logs and HTTP headers (User-Agent, Referer).
- **Detection methods and tools:**
- Scan file systems for vulnerable JAR files.
- Monitor network traffic for unauthorized outbound JNDI lookups.
## References
- Apache Security Advisory: hxxps[://]logging[.]apache[.]org/log4j/2[.]x/security[.]html
- Siemens Energy Advisory: Mentioned in context (Check vendor portal)
- NIST NVD CVE-2021-44228: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2021-44228
- NIST NVD CVE-2021-45046: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2021-45046