Log4j Vulnerability Attack Explained In Simple Terms

April 21, 2022

Last Updated date: March 21, 2023

Log4j Vulnerability Attack — Photo Credit: https://jackofalltechs.com/

If you ask a cyber security professional to name the most widespread vulnerabilities in recent years, the answer will probably be Log4j.

You can open Table of Contents show

Otherwise known as Log4Shell, this critical vulnerability has devastated and continues to damage businesses that rely upon online dealings. Since the Log4j v1 reached its end of life in 2015, Log4j v2 has been around for more than six years. As every version except 2.12.2 shows vulnerability, concerns in the tech and security industry are growing undoubtedly. In this article, we will look into why Log4j Vulnerability has become such a big deal with some measures to prevent it.

What is Log4j?

Log4j is a logging utility in the Apache server program maintained by the Apache Software Foundation (ASF). Apache being free and open-source software from large to medium and small enterprises turns to this utility for configuring a wide array of applications required to run an Apache server efficiently. The basic functionality of Log4j is to log data used by developers for debugging purposes.

What is the Log4j Vulnerability?

To name the type of vulnerability that Log4j possesses, it will be RCE. RCE is Remote Code execution where a blackhat hacker executes a malicious code or program remotely on the server to gain unauthorized access to damage the system or steal information about the company. Log4j is represented as a zero-day exploit, and the Common Vulnerability Scoring System CVSS rated it for the highest severity. This vulnerability, rated 10/10 under CVSS, shows its potential impact on any business organization. This security loophole can also get used to deploying cryptocurrency miners, keyloggers, and remote access Trojan Orcus to any remote server or personal raspberry pi server.

Systems Affected by Log4j

Log4j vulnerability affects various systems that use Apache Log4j versions from 2.0 to 2.14.1, excluding the 2.12.2 version. It encompasses all Apache frameworks such as Apache Druid, Apache Struts2, Apache Solr, Apache Flink, etc. The first company to acknowledge the flaw was Minecraft which suspected the risk of getting compromised in the Java version of the game. Tech vendors including Amazon Web Services, VMWare, IBM, Cisco, iCloud, Baidu, Fortinet, and Oracle are affected by the evils of this zero-day vulnerability.

What are the threats?

Log4j is a vendor-agnostic vulnerability that affects both proprietary and open-source software, leaving them open to exploitation. Not fixing the problems can damage the company’s reputation and disrupt business operations.

It can reveal confidential data to blackhats which will only reduce the customer’s trust.
Incident response and recovery costs also skyrocket resulting in organizational impact, ranging from crippling attacks to possible information theft and temporary loss of service.

According to experts, this affects numerous applications written in the Java programming language.

Attackers can gain control over the Thread Context Map (MDC) input data. It can happen if the logging configure uses a non-default patterns layout with either a context lookup or a thread context map pattern.
They can thus devise malicious input data using a JNDI Lookup pattern to effectuate a powerful DDoS attack.

How to prevent from getting Hacked?

Here are some remedial Techniques one can consider exploring to secure their systems.

#1: SOPHOS:

Install security patches in the system by upgrading it to the latest version.
Use mitigation techniques like enforcing better WAF rules and web filtering to block malicious CVE-2021-44228 requests.

#2: CiscoTalos:

Disable JNDI by default.
Limit default protocols to Java, LDAP, and LDAPS.
Set the Log4j2.enableJndi property to “true.”

#3: Apache Log4j:

Utilize Log4j 1 .x which is not influenced by this vulnerability and execute mitigation techniques for Log4j 2 .x.
Those using Java 8 or later should upgrade to release 2.16.0.
Remove JndiLookup class from classpath: zip -q -d log4j-core-*.jar org/apahe/loggin/log4j/core/lookup/JndiLookup.class.

#4: CISA:

Install a Web Application Firewall (WAF) and set rules which update themselves automatically. This way your Security Operations Team can concentrate on lesser alerts.
Enumerate all external-facing devices with Log4j installed in them.

Summing up

Log4j vulnerability is remote code execution (RCE) vulnerability that allows a malicious hacker to run code remotely on an enterprise server that runs Apache through web requests without any authentication. This approach allows them to get a hold over all the IT (Information Technology) and OT (Operational Technology Data) with less effort. OT industries can take a step-by-step approach to mitigate the security loopholes and tackle this vulnerability systematically and efficiently.