All Log4j, logback bugs we know so far and why you MUST ditch 2.15

All Log4j, logback bugs we know so far and why you MUST ditch 2.15

Everyone’s heard of the critical log4j zero-day by now. Dubbed ‘Log4Shell,’ the vulnerability has already set the internet on fire.

Thus far, the log4j vulnerability, tracked as CVE-2021-44228, has been abused by all kinds of threat actors from state-backed hackers to ransomware gangs and others to inject Monero miners on vulnerable systems.

Log4j usage is rampant among many software products and multiple vendor advisories have since surfaced. And, it now seems, ‘logback’ isn’t all that immune either.

Below we summarize the multiple relevant CVEs identified thus far, and pretty good reasons to ditch log4j version 2.15.0, in favor of 2.16.0.

Update Dec 18th, 05:33 AM ET: New 2.17.0 version is out now replacing 2.16.0 that has been found to be vulnerable to CVE-2021-45105, a DoS flaw.
The article below has been updated to include this new CVE along with an additional report released by BleepingComputer today.

What all CVEs should I be concerned about?

It all began last Thursday, December 9th, when a PoC exploit for the critical Log4j zero-day hit GitHub.

What followed was the vulnerability disclosure and mass-scanning activity from attackers targeting vulnerable servers.

Given Log4j’s vast usage in the majority of Java applications, Log4Shell soon turned into a nightmare for enterprises and governments worldwide.

Below are the CVEs in the order that they emerged that you should know about:

Ditch Log4j 2.15: DNS exfiltration & RCE possible

Log4j 2.15.0 might contain even more severe vulnerabilities than the ones discovered so far, which is why 2.16.0 is by far a safer bet.

Because of CVE-2021-45046 described above, the maximum impact from the flaw initially appeared to be DoS, but that assumption is evolving, BleepingComputer has learned.

Cloud security firm Praetorian demonstrated how Log4j 2.15.0 versions could still be abused for DNS-based data exfiltration from external hosts, and is working with Apache towards a coordinated disclosure.

In an email interview with BleepingComputer, Praetorian’s principal security engineer, Anthony Weems sheds more light on the research:

“The Praetorian blog post is in response to CVE-2021-45046, which applies to Log4j version 2.15. The CVE description states that—when using a specific type of Pattern Layout—this vulnerability can lead to a denial of service. The reason they state it is DoS only is due to the localhost allowlist,” Weems tells BleepingComputer.

“We’ve developed a bypass for this ‘localhost’ allowlist and sent the details to Apache. At minimum, this means systems that are vulnerable to CVE-2021-45046 are not just vulnerable to DoS, but also DNS exfil of potentially sensitive environment variables.”

Praetorian shared a PoC video demonstrating just this:

“Apache has confirmed receipt of our write-up; whether this merits an edit of the CVE or a new CVE is a good question – however, the action required by defenders is clear cut in either case: moving to 2.16.0 where jndi is disabled by default is the safest course of action, and is the approach we’re recommending for our customers,” concluded Praetorian in their statement to BleepingComputer.

Moreover, at the time of writing, BleepingComputer came across multiple security researchers claiming that it is possible to achieve full-on RCE, even with 2.15.0.

“Here is a PoC in how to bypass allowedLdapHost and allowedClasses checks in Log4J 2.15.0. to achieve RCE… and to bypass allowedClasses just choose a name for a class in the JDK. Deserialization will occur as usual,” explains researcher Márcio Almeida:

This happens because how the check was done. the https://t.co/KrgP5x639Q.URI getHost() method returns the value before the # as the real host. But the JNDI/LDAP resolver will resolve to the full hostname string attempting to connect to the malicious LDAP server. 2/n pic.twitter.com/HuZtYekuHw

— Márcio Almeida (@marcioalm)

Similarly, Alvaro Muñoz of GitHub Security Lab shared success with bypassing the fixes made to 2.15.0 to achieve remote code execution:

@_atorralba
and I just managed to bypass the allowedLdapHost and allowedClasses checks. 2.15 with no formatMsgNoLookups mitigations is still vulnerable to RCE. 2.15.0 w/o those mitigations is vulnerable only if attackers can control non-message parts of the pattern layout

— Alvaro Muñoz (@pwntester)

“As a side note, the default settings will not be affected. Lookup must be enabled by specifying %m{lookups} or by a method such as CVE-2021-45046,” says security researcher RyotaK, adding to Muñoz’s research.

The worst possible scenario resulting from Log4j 2.15.0 is yet to be fully determined, but suffice to say, it doesn’t seem like it’s just limited to DoS.

As the situation continues to evolve, organizations and developers are encouraged to upgrade to version 2.16.0, and to continue to monitor Apache’s Log4j advisory page for updates.

Update 09:11 AM ET: Severity for CVE-2021-45046 changed to Critical/9.0 according to Apache’s updated advisory page.

Related Articles:

This content was originally published here.

Laat een reactie achter

Het e-mailadres wordt niet gepubliceerd.