CVE-2021-44228 Log4j Security Vulnerability

Updated: Wed Dec 15 14:45:00 SAST 2021

Further vulnerabilities have been discovered with certain non-default configurations, which are not mitigated by setting `log4j2.noFormatMsgLookup` to `true`.

https://www.cve.org/CVERecord?id=CVE-2021-45046

---

Links

• https://www.lunasec.io/docs/blog/log4j-zero-day/
• https://www.lunasec.io/docs/blog/log4j-zero-day-mitigation-guide/
• https://github.com/lunasec-io/lunasec/releases/tag/v1.0.0-log4shell
• https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b

You can learn how to exploit this vulnerability in a safe environment here:

https://tryhackme.com/room/solar

You will need to create a login and then you can follow material presented. This is essentially a training site and they have provided this environment for free to allow anyone to learn more detail about this vulnerability in a more practice way.

Mitre: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

Vendor Links:

• Apache:
  • https://logging.apache.org/log4j/2.x/security.html
• Atlassian:
  • https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html
• Chef:
  • https://www.chef.io/blog/is-chef-vulnerable-to-cve-2021-44228-(log4j)
• Cloudera:
  • https://blog.cloudera.com/cloudera-response-to-cve-2021-4428/
• Docker:
  • https://www.docker.com/blog/apache-log4j-2-cve-2021-44228
• Elastic:
  • https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476
• Grafana:
  • https://grafana.com/blog/2021/12/14/grafana-labs-core-products-not-impacted-by-log4j-cve-2021-44228-and-related-vulnerabilities/
• HAProxy:
  • https://www.haproxy.com/blog/december-2021-log4shell-mitigation
• HashiCorp
  • https://discuss.hashicorp.com/t/hcsec-2021-32-hashicorp-response-to-apache-log4j-2-security-issue-cve-2021-44228
• RedHat:
  • https://access.redhat.com/security/vulnerabilities/RHSB-2021-009
  • OpenShift 4 – OpenShift Logging [Elasticsearch]
    • https://access.redhat.com/solutions/6578421
• Suse:
  • https://www.suse.com/c/suse-statement-on-log4j-log4shell-cve-2021-44228-vulnerability/
  • https://www.suse.com/security/cve/CVE-2021-44228.html
  • https://www.suse.com/support/kb/doc/?id=000020526
• Sysdig:
  • https://sysdig.com/blog/cve-critical-vulnerability-log4j/
• Ubuntu:
  • https://ubuntu.com/security/CVE-2021-44228
  • https://ubuntu.com/security/notices/USN-5192-1

---