Summary

• Caused by Apache Log4j's JNDI ("Java Naming and Directory Interface") features.
• How is it severe? The CVSS score is 10, the maximum, which means the highest risk.

Description

CVE-2021-44228 (named "log4shell" or "log4jam"): Remote code execution (RCE) severe vulnerability, discovered in Log4j, affects a wide range.

It's because Log4j is related to JAVA, one of general-purpose programming languages and used widely, and also used by popular frameworks such as Spring, Struts, LogStash and Solr etc. internally.

To be a pity, it's straightforward and easier for attackers to exploit the CVE-2021-44228 (log4shell) vulnerability. As to services open to some network, especially Internet, the situation is really dangerous.

It has been being considered as a historical one, with being referred to Heartbleed and Shell shock (or Bashdoor), discovered in 2014.

Updating Log4j version to 2.15.0 is strongly recommended.

How to fix it

• Strongly recommended to updated log4j version 2.15.0 (or later).

Second best and temporary ways to mitigate it

Well, When it's difficult to update #Log4j, they are possible:

• Use WAF.
• if ver >= 2.10.0: Disable JNDI lookup with system property (log4j2.formatMsgNoLookups) or environment variable (LOG4J_FORMAT_MSG_NO_LOOKUPS).
• else: Remove JndiLookup from classpath.

This post is based on the tweets by my company.