Full Report
On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as “Log4Shell”. On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Furthermore, one additional denial of service vulnerability, CVE-2021-45105, was disclosed. The Siemens Energy Sensformer / Sensgear cloud service was affected by these vulnerabilities and has remediated them. No user actions are necessary.
Analysis Summary
# Vulnerability: Apache Log4j Critical RCE and DoS Vulnerabilities (Log4Shell)
## CVE Details
- **CVE ID:** CVE-2021-44228 (Log4Shell), CVE-2021-45046, CVE-2021-45105
- **CVSS Score:**
- CVE-2021-44228: 10.0 (Critical)
- CVE-2021-45046: 9.0 (Critical) - *Updated from original 3.7*
- CVE-2021-45105: 7.5 (High)
- **CWE:** CWE-502 (Deserialization of Untrusted Data), CWE-400 (Uncontrolled Resource Consumption)
## Affected Systems
- **Products:** Apache Log4j (logging library), Siemens Energy Sensformer / Sensgear cloud service (remediated).
- **Versions:** Log4j 2.0-beta9 to 2.15.0.
- **Configurations:** Systems utilizing JNDI (Java Naming and Directory Interface) features and message lookup patterns; non-default configurations in version 2.15.0 remained vulnerable to CVE-2021-45046.
## Vulnerability Description
These vulnerabilities stem from the way Log4j handles log messages containing specific syntax (e.g., `${jndi:protocol://server/a}`).
- **CVE-2021-44228:** Improper validation of JNDI lookups allows an attacker to force the application to connect to an external malicious server and download/execute arbitrary code.
- **CVE-2021-45046:** An incomplete fix in 2.15.0 allowed for remote code execution and information disclosure via specific non-default layouts.
- **CVE-2021-45105:** A flaw in handling self-referential lookups allowed attackers to trigger a recursive loop, resulting in a Denial of Service (DoS) through a StackOverflowError.
## Exploitation
- **Status:** Exploited in the wild; PoC widely available.
- **Complexity:** Low
- **Attack Vector:** Network (Remote, unauthenticated)
## Impact
- **Confidentiality:** Total (Arbitrary code execution and data exfiltration)
- **Integrity:** Total (System takeover)
- **Availability:** Total (Service disruption and DoS)
## Remediation
### Patches
- **Log4j 2.16.0:** Disables JNDI by default and removes support for message lookups (fixes CVE-2021-44228 and CVE-2021-45046).
- **Log4j 2.12.2:** Fixes for Java 7 environments.
- **Log4j 2.17.0:** (Recommended) Addresses the DoS vulnerability (CVE-2021-45105).
### Workarounds
- For Siemens Energy Sensformer/Sensgear users: No action is necessary as the cloud service has been remediated by the provider.
- For other implementations: Disable JNDI lookups via configuration (`log4j2.formatMsgNoLookups=true`) or remove the `JndiLookup` class from the classpath (Note: early mitigations were found to be incomplete; patching is strongly preferred).
## Detection
- **Indicators of Compromise:** Unusual outbound connections (LDAP, RMI, DNS) from application servers to unknown IP addresses. Log entries containing `${jndi:...}` strings.
- **Detection methods and tools:** Scanning tools for vulnerable JAR files; EDR/NDR monitoring for unauthorized Java process spawns or suspicious network traffic on port 1389 or 389.
## References
- Apache Log4j Security Page: hxxps[://]logging[.]apache[.]org/log4j/2[.]x/security[.]html
- Siemens Security Advisory: hxxps[://]www[.]siemens-energy[.]com/global/en/home/products-services/cybersecurity[.]html
- CVE Database: hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2021-44228