Apache Log4j has a critical vulnerability that allows unauthenticated remote code execution. This vulnerability can be triggered by a specially crafted string that is passed to the application’s log server. Web applications typically store the user agent string of the browser used by visitors. Using a specially crafted string, an attacker could craft input data that would cause a StackOverflowError or even a Denial-of-Service attack. This vulnerability affects many versions of the Apache Log4j application.
Security experts believe that the flaw in Apache Log4j has the potential to create a mini-internet meltdown. Because the vulnerability impacts so many popular applications and frameworks, including Apache Struts2, Apache Solr, Apache Flink, and Apache Druid, it’s a major vulnerability that could affect thousands of organizations. For example, a Minecraft server that has been compromised may also be at risk. Similarly, Apple’s iCloud service could be compromised.
An open-source logging library, Apache Log4j, is widely used in web applications and Java-based apps. As a result, this vulnerability is highly dangerous and can be exploited by an attacker to execute arbitrary code. Apache has since released version 2.15.0 that addresses this vulnerability and addresses the issue. However, organizations should review any public apps to determine whether they are vulnerable and take the appropriate measures to mitigate the risk.
The vulnerability affects versions 2.0 to 2.14.1 of Apache Log4j. The vulnerability has been reported on GitHub. The affected versions of Log4j can be exploited by an adversary who can send specially crafted requests to the vulnerable system. Once a hacker gains access to a system, they can steal information, launch ransomware, and conduct other malicious activities. While Apache has released a patch for this vulnerability, many organizations are still vulnerable to this vulnerability.
This vulnerability affects the Java EE environment. In addition to exposing data in plain text, it can also expose sensitive information. The affected Java EE applications include NetBackup. NetBackup does not use context lookups in its log4j logging configuration, but it can be exploited through the JDBC Appender. The affected versions of NetBackup do not use the JMSAppender or SocketServer functionality.
Threat hunting tools can help detect and prevent exploit attempts against your Log4j application. Google’s Threat Hunting service, known as Chronicle, is an excellent example. This tool lets you collect metadata related to API traffic and can identify patterns of exploit attempts. Using a regular expression or Raise Fault policy, you can block such attempts. You can also check the history of exploit attempts by blocking them with these tools. They have helped many enterprises combat their security challenges.
A recent vulnerability in Log4j has made it a security risk. While some people thought the vulnerability would affect only Log4j 2.x versions, it has affected 1.x as well. Although Log4j 2.x has direct support for JNDI, the first version of Log4j did not provide this functionality. However, it had JMSAppender objects that enabled users to execute JNDI requests. In August 2015, this version reached end of life, and users are advised to upgrade to Log4j 2.x.
