Full Report
On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in many Java-based applications) was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2021-44228 and is also known as “Log4Shell”. On 2021-12-14 an additional denial of service vulnerability (CVE-2021-45046) was published rendering the initial mitigations and fix in version 2.15.0 as incomplete under certain non-default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed to fix both vulnerabilities. Siemens Energy is preparing updates and recommends specific countermeasures.
Analysis Summary
# Vulnerability: Apache Log4j RCE and DoS (Log4Shell)
## CVE Details
- **CVE ID:** CVE-2021-44228, CVE-2021-45046
- **CVSS Score:** 10.0 (Critical) for CVE-2021-44228; 9.0 (Critical) for CVE-2021-45046
- **CWE:** CWE-502 (Deserialization of Untrusted Data), CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement)
## Affected Systems
- **Products:** Apache Log4j logging library and Java-based applications utilizing it (specifically Siemens Energy products in this context).
- **Versions:** 2.0-beta9 to 2.15.0 (Note: 2.15.0 was found to be incomplete for CVE-2021-45046).
- **Configurations:** Systems utilizing JNDI (Java Naming and Directory Interface) features; CVE-2021-45046 specifically affects certain non-default configurations involving Context Lookup patterns.
## Vulnerability Description
CVE-2021-44228 is a remote code execution (RCE) flaw where the library fails to protect against attacker-controlled LDAP and other JNDI-related endpoints. When a specially crafted string is logged, the software uses the JNDI to fetch a resource from a remote server, which can result in the execution of arbitrary code. CVE-2021-45046 is a subsequent flaw where the initial fix in 2.15.0 was insufficient, potentially allowing a Denial of Service (DoS) or further RCE in specific configurations.
## Exploitation
- **Status:** Exploited in the wild; Proof of Concept (PoC) widely available.
- **Complexity:** Low
- **Attack Vector:** Network (Remote, unauthenticated)
## Impact
- **Confidentiality:** Total
- **Integrity:** Total
- **Availability:** Total
## Remediation
### Patches
- **Apache Log4j 2.16.0:** Disables JNDI by default and removes support for message lookups (Recommended for Java 8+).
- **Apache Log4j 2.12.2:** Backported fix for Java 7.
- **Siemens Energy Updates:** Currently in preparation; users should monitor official Siemens Energy channels for product-specific firmware/software updates.
### Workarounds
- For versions >= 2.10: Set the system property `log4j2.formatMsgNoLookups` or the environment variable `LOG4J_FORMAT_MSG_NO_LOOKUPS` to `true`.
- For versions < 2.10: Remove the `JndiLookup` class from the classpath: `zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class`.
## Detection
- **Indicators of Compromise:** Review logs for strings containing `${jndi:ldap://`, `${jndi:rmi://`, or similar JNDI lookup patterns directed at external/untrusted IP addresses.
- **Detection Methods:** Vulnerability scanners (e.g., Nessus, OpenVAS) and specialized Log4shell scripts (e.g., LunaSec, specialized Nmap scripts) to identify vulnerable library versions in the environment.
## References
- **Vendor advisories:** hxxps[://]www[.]siemens-energy[.]com/global/en/home/products-services/cybersecurity.html
- **Apache Security:** hxxps[://]logging[.]apache[.]org/log4j/2.x/security.html
- **NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2021-44228