Full Report
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 contain a vulnerability (CVE-2021-45105) that could allow attackers to cause a denial of service condition in affected applications [1]. This advisory informs about the impact of CVE-2021-45105 to Siemens products and the corresponding remediation and mitigation measures. The vulnerability is different from the JNDI lookup vulnerabilities, the impact of which is documented in SSA-661247 [2]. Currently, no products vulnerable to CVE-2021-45105 have been identified. Siemens is investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. See section Additional Information for more details regarding the investigation status. [1] https://logging.apache.org/log4j/2.x/security.html [2] https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
Analysis Summary
# Vulnerability: Apache Log4j2 Infinite Recursion Denial of Service (DoS)
## CVE Details
- **CVE ID:** CVE-2021-45105
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-674 (Uncontrolled Recursion)
## Affected Systems
- **Products:** Siemens products (Currently under investigation); Apache Log4j2.
- **Versions:** Apache Log4j2 versions 2.0-alpha1 through 2.16.0.
- **Configurations:** Systems where Log4j2 is configured to use a non-default Pattern Layout with a Context Lookup (e.g., `$${ctx:loginId}`).
## Vulnerability Description
Apache Log4j2 does not protect from uncontrolled recursion from self-referential lookups. When a nested variable is substituted by the `StrSubstitutor` class, it can allow an attacker to craft a malicious input string containing recursive lookups. This results in a `StackOverflowError` that terminates the Java Virtual Machine (JVM), leading to a Denial of Service (DoS) condition. This is distinct from the JNDI/Log4Shell vulnerabilities as it focuses on resource exhaustion rather than remote code execution.
## Exploitation
- **Status:** PoC available; widely discussed in the context of the Log4j vulnerability chain.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (System crash/Denial of Service)
## Remediation
### Patches
- **Apache Log4j 2.17.0 (for Java 8):** Introduced fixed `StrSubstitutor` logic to prevent recursion.
- **Apache Log4j 2.12.3 (for Java 7):** Backported fix.
- **Siemens Products:** No specific Siemens product versions have been identified as vulnerable yet. Users should monitor Siemens advisory updates as the investigation continues.
### Workarounds
- **Configuration Update:** In the Log4j configuration, replace Context Lookups like `${ctx:loginId}` or `$${ctx:loginId}` with Thread Context Map patterns (%X, %mdc, or %MDC).
- **Policy Update:** In the layout configuration, remove references to Context Lookups where data is sourced from external inputs (e.g., HTTP headers).
## Detection
- **Indicators of Compromise:** Look for repeated `StackOverflowError` entries in application logs, specifically originating from `org.apache.logging.log4j.core.lookup.StrSubstitutor`.
- **Detection Methods:** Scanning tools (SBOM scanners) to identify the presence of Log4j-core JAR files in versions < 2.17.0.
## References
- **Apache Security Advisory:** hxxps[://]logging[.]apache[.]org/log4j/2[.]x/security[.]html
- **Siemens SSA-661247 (Related JNDI info):** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-661247[.]pdf
- **NIST NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2021-45105