Full Report
On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as “Log4Shell”. On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was reclassified with an increased CVSS base score (from 3.7 to 9.0). The potential impact of CVE-2021-45046 now includes - besides denial of service - also information disclosure and local (and potential remote) code execution. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as more information becomes available. See section Additional Information for more details regarding the investigation status. Note: two additional vulnerabilities were published for Apache Log4j, the impact of which are documented in SSA-501673: https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf (CVE-2021-45105) and SSA-784507: https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf (CVE-2021-44832).
Analysis Summary
# Vulnerability: Log4Shell and Associated Apache Log4j Flaws
## CVE Details
- **CVE ID:** CVE-2021-44228 (Log4Shell), CVE-2021-45046
- **CVSS Score:**
- CVE-2021-44228: 10.0 (Critical)
- CVE-2021-45046: 9.0 (Critical) - *Updated from original 3.7*
- **CWE:** Not specified in text (Typically associated with CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement)
## Affected Systems
- **Products:** Java-based applications utilizing Apache Log4j; specifically Siemens products currently under investigation.
- **Versions:**
- Log4j 2.0-beta9 to 2.14.1 (CVE-2021-44228)
- Log4j 2.15.0 (Vulnerable to CVE-2021-45046 under certain non-default configurations)
- **Configurations:** Systems where Log4j is used to log user-supplied input; non-default configurations in version 2.15.0 remain vulnerable to RCE and Information Disclosure.
## Vulnerability Description
These vulnerabilities exist in the Apache Log4j library's handling of log messages. CVE-2021-44228 allows for unauthenticated Remote Code Execution (RCE) via JNDI lookups when a specially crafted string is logged. While version 2.15.0 attempted to fix this, CVE-2021-45046 was discovered, demonstrating that the fix was incomplete. This secondary flaw allows for Denial of Service (DoS), information disclosure, and potential local/remote code execution due to improper validation of certain non-default layouts.
## Exploitation
- **Status:** Exploited in the wild; PoC available.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Information disclosure and data exfiltration possible)
- **Integrity:** High (Full system compromise via RCE)
- **Availability:** High (Denial of Service and system takeover)
## Remediation
### Patches
- **Log4j 2.16.0:** Disables JNDI by default and removes support for message lookups (Fixes both CVEs).
- **Log4j 2.12.2:** Backported fix for Java 7 environments.
- **Siemens Products:** Users should monitor the Siemens advisory for product-specific firmware/software updates.
### Workarounds
- The initial mitigations provided for 2.15.0 (such as setting `formatMsgNoLookups` to `true`) are considered **incomplete** for CVE-2021-45046. The primary recommendation is to update the library to 2.16.0 or higher.
## Detection
- **Indicators of compromise:** Presence of JNDI lookup strings (e.g., `${jndi:ldap://...}`) in application logs.
- **Detection methods and tools:** Scanning for vulnerable versions of the `log4j-core` JAR file and monitoring network traffic for unauthorized JNDI/LDAP/RMI connections.
## References
- Siemens Security Advisory: hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-501673[.]pdf
- Siemens Security Advisory: hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-784507[.]pdf
- Apache Logging Services Security Page: hxxps[://]logging[.]apache[.]org/log4j/2[.]x/security[.]html