Executive brief
Apache Log4j2 is a widely used logging library for Java applications. A vulnerability exists where an attacker who already has permission to modify the application's logging configuration can trigger remote code execution. While this requires significant existing access, a successful exploit could allow an attacker to take full control of the server or access sensitive data.
Technical details
Apache Log4j2 (log4j-core) is vulnerable to an injection attack (CWE-74) via improper input validation (CWE-20). An attacker with the ability to modify the logging configuration file can define a JDBC Appender with a data source referencing a malicious JNDI URI. This can lead to remote code execution when the configuration is loaded. The attack vector is network-based but requires high privileges (PR:H) and has high complexity (AC:H) because default configurations are not affected. The issue is resolved in versions 2.17.1, 2.12.4, and 2.3.2 by restricting JNDI data source names to the 'java' protocol.
Affected products
- Apache log4j-core >= 2.0-beta7, < 2.3.2; >= 2.4, < 2.12.4; >= 2.13.0, < 2.17.1
- OPS4J pax-logging-log4j2 >= 1.8.0, < 1.9.2; >= 1.10.0, < 1.10.9; >= 1.11.0, < 1.11.13; >= 2.0.0, < 2.0.14
Timeline
- 2021-12-28: disclosed
- 2021-12-28: advisory
- 2022-01-04: patched: GitHub Advisory published with fix versions