Critical ‘Log4Shell’ Zero-Day Vulnerability Wreaks Havoc Online

A highly critical vulnerability affecting the Apache Log4j library has potentially shaken the internet. This ‘Log4Shell’ vulnerability is already under attack and affects various services including Twitter, iCloud, Apple, and Minecraft.

‘Log4Shell’ Zero-Day Vulnerability Has A Wide Attack Surface

Researchers have shared insights about a critical Apache Log4j vulnerability that affects numerous services.

Identified as CVE-2021-44228, and informally named as ‘Log4shell’ by LunaSec, this vulnerability is a typical remote code execution flaw that affects the apps running this Java logging library.

As listed in a new GitHub repo, some of the affected services even include Apple, Amazon, Twitter, Tencent, Steam, Baidu, Cloudflare, Tesla, Ghidra, Google, WebEx, LinkedIn, and more. Whereas, the vulnerability was first caught affecting Minecraft.

According to the official description of this vulnerability from Apache, it’s an RCE flaw that allows an attacker to take control of the target servers. As stated,

Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker-controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default.

Apache has confirmed that this vulnerability impacts Log4j 2 versions from 2.0-beta9 to 2.14.1.

Apache Deployed The Patches

Regrettably, New Zealand CERT has admitted in an advisory that the bug is already under attack in the wild.

Hence, it is imperative for the users to ensure receiving the latest Log4j version to get the patches. The US CERT has also urged on these updates in their recent advisory.

Specifically, Apache has released Log4j version 2.15.0, addressing this vulnerability. Also, they have shared a mitigation for this bug in their advisory that reads,

In releases >=2.10, this behavior can be mitigated by setting either the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true. For releases from 2.0-beta9 to 2.10.0, the mitigation is to remove the JndiLookup class from the classpath: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class.

Hence, given the active exploitation of the bug and the availability of PoC exploits on Twitter and GitHub, users must rush to update.

Let us know your thoughts in the comments.