5

Tech Solvency: The Story So Far: CVE-2021-44228 (Log4Shell log4j vulnerability).

 2 years ago
source link: https://www.techsolvency.com/story-so-far/cve-2021-44228-log4j-log4shell/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.

CVE-2021-44228 (Log4Shell log4j vulnerability).

Log4Shell log4j vulnerability (CVE-2021-44228 / CVE-2021-45046) - cheat-sheet reference guide

Last updated: $Date: 2021/12/15 22:47:17 $ UTC - best effort, validate all for your environment/model before use

by @TychoTithonus (Royce Williams), standing on the shoulders of many giants
Send updates or suggestions (please include category / context / public (or support-walled) links if you can)

Contents

NOTE: All previous mitigations based on anything other than "upgrade to log4j 2.16" or entirely removing JndiLookup classes are likely not full mitigation
(but still useful coverage while waiting for later vendor guidance)

Who is affected

  • Impact: arbitrary code execution as the user the parent process is running as (code fetched from the public Internet, or lolbins already present on system, or just fetching shared secrets or environment variables and returning them to the attacker)
  • Targets: Servers and clients that run Java and also log anything using the log4j framework - primarily a server-side concern, but any vulnerable endpoint could be a target or a pivot point
  • Downstream projects: until proven otherwise, assume anything that includes log4j, or depends on something that does, is affected in a way that requires mitigation; see below
  • Affected versions: log4j 2.x confirmed - log4j 1.x only indirectly (previous information disclosure vulns, harder to exploit) (in some configurations). Also, presence of 1.x is not good - 1.x went EOL in August 2015!
  • Appliances: Don't forget appliances and other opaque or third-party systems that may be using Java server components, but won't be detected by un-credentialed vulnerability scanning or simple exploitation tests
  • Log forwarding: logging infrastructure often has many "northbound" (send my logs to someone) and "southbound" (receiving logs from someone) forwarding/relaying topologies. Chaining them together for exploitation must also be considered.
  • Cloud: Multiple large providers also affected (but this guide focuses mostly on customer-managed side)
  • Misnomers: No, it is not also called LogJam. That name is already taken. (Initial LunaSec post used that name, then picked a new one once they found out.)
  • Pronunciation: its main author pronounces it "log 4 jay", not "logforge"
  • Deadlines: CISA orders federal agencies to patch Log4Shell by December 24th

Scope / seriousness

  • "hearing folks compare #log4shell is "as bad as heartbleed" - imo it's much, much worse. aside from having RCE as the impact, the number of interdependencies around log4j (and particularly the age of them) is orders of magnitude higher" -@caseyjohnellis
  • "What people seem to miss: The #Log4Shell vulnerability isn't just a RCE 0day. It's a vulnerability that causes hundreds and thousands of 0days in all kinds of software products. It's a 0day cluster bomb." -@cyb3rops (Florian Roth)
  • "A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence." - @rakyll (AWS)
  • The Wikipedia article on log4j is informative to understand usage and scope
  • Earliest detection known: 2021-12-01 04:36:50 UTC

back to top

Summaries

back to top

Technical analysis

back to top

Remediation

Direct remediation:

Mitigations - easiest

  • (@MalwareTechBlog): If you can't upgrade log4j, you can mitigate the RCE vulnerability by setting log4j2.formatMsgNoLookups to True (-Dlog4j2.formatMsgNoLookups=true in JVM command line) (but only for >= 2.10.0).
  • Putting Cloudflare in front of your site (and terminating your SSL there) could be an easy but only partial solution

Mitigations - official project itself (https://logging.apache.org/log4j/2.x/)

  • Users of Log4j 2.10 or greater may add -Dlog4j2.formatMsgNoLookups=true as a command line option or add log4j2.formatMsgNoLookups=true to a log4j2.component.properties file on the classpath to prevent lookups in log event message.
  • Users since Log4j 2.7 may specify %m{nolookups} in the PatternLayout configuration to prevent lookups in log event message
  • Remove the JndiLookup and JndiManager classes from the log4j-core jar. Removal of the JndiManager will cause the JndiContextSelector and JMSAppender to no longer function

Mitigations - harder

Mitigations - ecosystem

back to top

Affected (and unaffected) products

Note: this list focuses primarily on customer-controlled components. For fully cloud-based components, top section of the YfryTchsGD repo is pretty good as a starting point.

Disclaimer: caching/summaries is best effort and may be out of date or incorrect - always validate for yourself

Claimed patched (previously vulnerable, now remediated/mitigated or updates available)

Confirmed affected - version differences, workarounds suggested, status pending, or not yet analyzed

  • Apache Struts (LunaSec ref only, need better link)
  • Apache James SMTP Server - Twitter PoC (@dlitchfield)
  • Apereo CAS and community workarounds
  • Forescout - unconfirmed - KB 12049 (support wall); all versions now have patches available - minimum base version patches may be required first; see also blog post
  • IGEL - only UMS affected - patch
  • ManageEngine (ADManager Plus, ADAudit Plus, etc) - commmunity post, official reply, patch as caution
  • neo4j (community official post, 4.2+ affected, workaround, patched release pending)
  • OpenMRS (suggests -D workaround, patched release pending)
  • PEGA (remediation via SQL cmd for on prem and self-managed)
  • Rosette - only RNI WebServices (deprecated product) - "vulnerability will be removed"
  • Powerschool (Reddit only, appears exploitable, official pending)
  • SAFE FME Server - not vulnerable, updating 2.x to 2.15 anyway, but also not providing patches for unsupported versions
  • SDL WorldServer affected, workarounds listed
  • Seafile - Pro only, Elastic search dependency, workarounds listed, risk "low"
  • Silver Peak GMS Orchestrator (Aruba/HPE) - no patch yet, workarounds listed
  • Tosca - licensing server uses Elasticsearch, claimed OK but patch also pending; Java Engine patch pending
  • Wowza Media Server - one private report as affected

Claimed unaffected / not vulnerable (no action taken or required)

Claimed unaffected by default (but configurable to be affected if user opted for log4j or added extensions)

Multi-product - vulnerable, mixed, or not yet fully determined

Potentially affected (circumstantial use of log4j or behind support wall)

Not yet determined, non-commital, or mixed/controversial

  • Apache Kafka claimed unaffected, but this pull request seems to show otherwise
  • Blender (original claimed PoC was apparently a joke)
  • DocuSign ("patching or mitigating as vulnerable configurations are identified")
  • Elastic - claimed no RCE in Elasticsearch, but an info disclosure vuln was patched, but this community thread is mixed (2021-12-11 23:49 UTC). Elastic Cloud on Kubernetes requires mitigations. Other components/offerings listed as unaffected.
  • Flexera / Revenera (placeholder / in progress - 2021-12-13 02:56 UTC)
  • Mathematica (community forum only, not definitive)
  • Nextcloud (no Java per GitHub issue, but replies indicate potential for otherwise)
  • SmartBear (official) - working on mitigations, no statement of direct log4j involvement
  • Untangle (community forum only, no authoritative answer 2021-12-13 04:21)

Indirect / integration known (can relay/forward/integrate, but no default dependency)

Other rollup lists

back to top

Detection

Finding potentially vulnerable software

Detecting exploitation attempts

Vulnerability scanning and testing

Multi-layered defense stacks and guides

back to top

Exploitation

back to top

News and posts

back to top

Return to The Story So Far (list of notable security events)

Follow @techsolvency for security-only updates, or @TychoTithonus (me) for general/personal


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK