CVE-2021-44832: Apache Log4j2 remote code execution via JDBC Appender JNDI injection

CVE-2021-44832 · Severity: medium · CVSS 6.6 · Published 2022-01-04

Apache Log4j2 is a widely used logging library for Java applications. A vulnerability exists where an attacker who already has permission to modify the application's logging configuration can trigger remote code execution. While this requires significant existing access, a successful exploit could allow an attacker to take full control of the server or access sensitive data.

Technologies: Apache Software Foundation Log4j Core, org.apache.logging.log4j:log4j-core (Maven), org.ops4j.pax.logging:pax-logging-log4j2 (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2021-44832 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-44832 being exploited in the wild.
How severe is CVE-2021-44832?
Medium severity, with a CVSS score of 6.6, published 4 January 2022.
Which products and versions are affected?
Apache Software Foundation Log4j Core >= 2.0-beta7, < 2.3.2; >= 2.4, < 2.12.4; >= 2.13.0, < 2.17.1; org.apache.logging.log4j:log4j-core (Maven) ECOSYSTEM:introduced=2.0-beta7,fixed=2.3.2; org.ops4j.pax.logging:pax-logging-log4j2 (Maven) ECOSYSTEM:introduced=1.8.0,fixed=1.9.2; OPS4J Pax-Logging-Log4j2 >= 1.8.0, < 1.9.2; >= 1.10.0, < 1.10.9; >= 1.11.0, < 1.11.13; >= 2.0.0, < 2.0.14.
Is there a fix for CVE-2021-44832?
Yes. org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.3.2 or later; org.ops4j.pax.logging:pax-logging-log4j2 (Maven): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-44832 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-44832?
Check whether you run Apache Software Foundation Log4j Core, org.apache.logging.log4j:log4j-core (Maven), org.ops4j.pax.logging:pax-logging-log4j2 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.3.2 or later
    # set org.apache.logging.log4j:log4j-core to 2.3.2 in your pom.xml or build.gradle
  • org.ops4j.pax.logging:pax-logging-log4j2 (Maven): upgrade to 1.9.2 or later
    # set org.ops4j.pax.logging:pax-logging-log4j2 to 1.9.2 in your pom.xml or build.gradle

Technical details

Apache Log4j2 (log4j-core) is vulnerable to an injection attack (CWE-74) via improper input validation (CWE-20). An attacker with the ability to modify the logging configuration file can define a JDBC Appender with a data source referencing a malicious JNDI URI. This can lead to remote code execution when the configuration is loaded. The attack vector is network-based but requires high privileges (PR:H) and has high complexity (AC:H) because default configurations are not affected. The issue is resolved in versions 2.17.1, 2.12.4, and 2.3.2 by restricting JNDI data source names to the 'java' protocol.

Affected products

  • Apache log4j-core >= 2.0-beta7, < 2.3.2; >= 2.4, < 2.12.4; >= 2.13.0, < 2.17.1
  • OPS4J pax-logging-log4j2 >= 1.8.0, < 1.9.2; >= 1.10.0, < 1.10.9; >= 1.11.0, < 1.11.13; >= 2.0.0, < 2.0.14

Identifiers

  • CVE-2021-44832
  • GHSA-8489-44mv-ggj8

Timeline

  • 2021-12-28: disclosed
  • 2021-12-28: advisory
  • 2022-01-04: patched: GitHub Advisory published with fix versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.