Executive brief
Apache Log4j 1.2 contains a component used for receiving log data over a network that is vulnerable to a critical security flaw. An attacker can exploit this to remotely take control of the server or execute unauthorized commands. This version of the software is end-of-life, and organizations are urged to migrate to a modern version of Log4j to protect their data and operations.
Technical details
The SocketServer class in Apache Log4j versions 1.2 through 1.2.17 is vulnerable to deserialization of untrusted data. When the SocketServer is configured to listen for log data on a network port, it fails to properly validate incoming serialized objects. A remote, unauthenticated attacker can send a specially crafted malicious payload that, when combined with a suitable deserialization gadget on the classpath, results in arbitrary code execution. No patch is available for the 1.2.x branch as it has reached end-of-life; users must migrate to log4j-core (Log4j 2.x).
Affected products
- Apache Log4j >= 1.2, <= 1.2.17
Timeline
- 2020-01-06: advisory: GitHub Advisory published