The Log4j 2 Security Vulnerability Incident (Log4Shell)
Categories:
A vulnerability in Apache Log4j 2 (CVE-2021-44228, NVD) could lead to further damage such as malware infection, prompting urgent security update measures worldwide (2021.12.10). This post summarizes the related details.
Log4j
Log4j is an open source project from the Apache Software Foundation, used for logging purposes in most Java-based web services.
Timeline
- 2021.11.24 First discovered by the Alibaba Cloud security team (Apache announcement)
- 2021.11.30 The Log4j team opened the pull request Restrict LDAP access via JNDI (merged 12/5)
- 2021.11.30 The Log4j team opened the pull request no longer formats lookups in messages by default (merged 12/5)
- 2021.12.09 The issue began to spread after a tweet posted the Log4j 2 security PR along with a screenshot reproducing the vulnerability
- 2021.12.10 The issue gained widespread attention after Minecraft’s technical lead announced via tweet that the issue had been fixed
- 2021.12.10 The security vulnerability was patched with the release of Log4j 2.15.0
- 2021.12.12 The Log4j team added Disable JNDI by default
- 2021.12.12 Log4j 2.15.1 release candidate (JNDI disabled by default)
Press Coverage (Korea)
- 2021.12.11 “Worst vulnerability in the history of computing found” — global security industry stunned
- 2021.12.11 Worst-ever ‘Log4j’ security flaw discovered, threatening nearly every server
- 2021.12.11 Following reports of “the worst vulnerability in the history of computing,” the National Intelligence Service says it has “taken preemptive measures”
- 2021.12.12 Ministry of Science and ICT recommends urgent security measures for the “critically vulnerable” open source project Log4j
- 2021.12.12 “The worst security flaw” — the IT industry thrown into turmoil
- 2021.12.12 Electronic Times: damage is hard to assess — software details need to be identified
- 2021.12.12 ‘Emergency response team’ activated amid concerns over IT server hacking
- For coverage outside Korea, search for “Log4Shell”
Response Measures
- Security advisories/notices related to Log4Shell (CVE-2021-44228)
- 2021.12.06 Apache notice on 2.15.0 regarding CVE-2021-44228
- 2021.12.10 Spring, Log4J2 Vulnerability and Spring Boot
- 2021.12.11 KISA (Korea Internet & Security Agency), advisory on the Apache Log4j 2 security update
- 2021.12.12 Ministry of Science and ICT, urgent security patch recommendation for Apache Log4j 2 web services (the guidance is the same as above)
Response Examples (Reference)
- 2021.12.10 AWS, Apache Log4j2 Issue
- 2021.12.11 How Cloudflare Security responded to the Log4j 2 vulnerability
Scope of Impact
Log4j versions from 2.0-beta9 up to (but not including) 2.15.x
- Spring Boot defaults to a different logging library, Logback, and is affected by the vulnerability only
if the default logging system has been switched to Log4j2. - As of 2021.12.12, in Spring Boot 2.6.1 (the latest version at the time), switching to Log4j2 without specifying a version installs 1.14.1
- Spring Boot 2.6.2, not yet released at the time, was planned to update to Log4j 2.15.x
- Spring Boot defaults to a different logging library, Logback, and is affected by the vulnerability only
Known Vulnerability Scanners
Labrador Log4Shell code-level inspection tool (jointly developed by Labrador Labs and the Korea University Security Research Institute)
Labrador Log4Shell test
- (Step 1) Scan via package management, then (Step 2) scan Jar files
- Tested using a Spring Boot 2.6.1 sample project (GitHub) (create your own)
$java -jar LabradorLog4ShellDetector.jar -project [path] - Scanning the default Spring project: no vulnerability found
- After switching the logging system to Log4j2
Attack Method
- Log4Shell is classified as an RCE (Remote Code Execution) vulnerability.
- It carries the risk of zero-day attacks (attacks that exploit a publicly disclosed but not yet patched security vulnerability).
- See here for details
Image source
Government Considers Surveying Open Source Usage
The government is also considering ways to raise the security level of open source software. A Ministry of Science and ICT official said, “Because there is so much open source in use, similar incidents are likely to occur again,” and added, “we are considering follow-up measures, including a usage survey.”
(excerpted from this article)