Security Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit (Log4Shell)

Revenge · Dec 11, 2021

Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit

https://www.zdnet.com/article/secur...og4j-java-library-is-already-being-exploited/

Severe vulnerability in Java logging libraries allows unauthenticated remote code execution and access to servers, warn researchers.

A newly discovered zero-day vulnerability in the widely used Java logging library Apache Log4j is easy to exploit and enables attackers to gain full control of affected servers.
Click to expand...

Jimmy · Dec 11, 2021

Full Control.

"Houston we have a problem."

Rake-GH · Dec 11, 2021

This is a serious issue, I just came here to post this.

Xenforo Enhanced Search (the paid official addon) uses Elastic Search, which uses Log4j so it's possible that it's vulnerable.

I already had someone try to exploit it on my site by putting the exploit into the search box

But I don't used Enhanced Search so I'm not worried about it

Matt · Dec 11, 2021

Adding this to my jvm.options file on all my servers currently
Code:
# Apache Log4j Zero-Day Exploit
-Dlog4j2.formatMsgNoLookups=true
https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439

eva2000 · Dec 11, 2021

edit: Looks like log4j 2.16 is out now as 2.15 didn't fully fix the vulnerability https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0

Disable JNDI by default. Require log4j2.enableJndi to be set to true to allow JNDI. Fixes LOG4J2-3208

Completely remove support for Message Lookups. Fixes LOG4J2-3211

Interesting indeed https://blog.cloudflare.com/how-cloudflare-security-responded-to-log4j2-v

Yesterday, December 9, 2021, when a serious vulnerability in the popular Java-based logging package log4j was publicly disclosed, our security teams jumped into action to help respond to the first question and answer the second question. This post explores the second.

We cover the details of how this vulnerability works in a separate blog post: Inside the log4j2 vulnerability (CVE-2021-44228), but in summary, this vulnerability allows an attacker to execute code on a remote server. Because of the widespread use of Java and Log4j, this is likely one of the most serious vulnerabilities on the Internet since both Heartbleed and ShellShock. The vulnerability is listed as CVE-2021-44228. The CVE description states that the vulnerability affects Log4j2 <=2.14.1 and is patched in 2.15. The vulnerability additionally impacts all versions of log4j 1.x; however, it is End of Life and has other security vulnerabilities that will not be fixed. Upgrading to 2.15 is the recommended action to take. You can also read about how we updated our WAF rules to help protect our customers in this post: CVE-2021-44228 - Log4j RCE 0-day mitigation
Click to expand...

We were able to create an inventory of all software we have running on the JVM using our centralized code repositories. We used this information to research and determine each individual Java application we had, whether or not it contained log4j, and which version of log4j was compiled into it.

We discovered that our ElasticSearch, LogStash, and Bitbucket instances contained the vulnerable versions of log4j between versions 2.0 and 2.14.1. We concluded that mitigating this vulnerability could be done in two ways. First was updating to a non-vulnerable version of log4j. Additionally, for some versions of log4j, a specific configuration directive in the log4j.properties files could mitigate the issue.

log4j2.formatMsgNoLookups=true

We were able to quickly mitigate this issue in these packages using log4j by configuring this directive while waiting for new versions of those packages to be released.
Click to expand...

Cloudflare paid plan users with CF WAF enabled would automatically be protected too

And because we have the Cloudflare WAF product deployed as part of our effort to secure Cloudflare using Cloudflare, we benefited from all the work being done to protect our customers. All new WAF rules written to protect against this vulnerability were updated with a default action of BLOCK. Like every other customer who has the WAF deployed, we are now receiving protection without any action required on our side.
Click to expand...

eva2000 · Dec 11, 2021

And

https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/

https://blog.cloudflare.com/actual-cve-2021-44228-payloads-captured-in-the-wild/

https://blog.cloudflare.com/secure-how-your-servers-connect-to-the-internet-today/

eva2000 · Dec 11, 2021

Matt said: ↑
Adding this to my jvm.options file on all my servers currently
Code:
# Apache Log4j Zero-Day Exploit
-Dlog4j2.formatMsgNoLookups=true
https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439
Click to expand...
Some folks are reporting that isn't working whether it's because they implemented it incorrectly or not, not sure. Probably best to just switch to native XF search temporarily until more about the security issue is known.

Matt · Dec 11, 2021

https://discuss.elastic.co/t/apache...lnerability-cve-2021-44228-esa-2021-31/291476

eva2000 · Dec 11, 2021

Matt said: ↑

https://discuss.elastic.co/t/apache...lnerability-cve-2021-44228-esa-2021-31/291476
Click to expand...

Yup following along with that thread

Looks like cPanel and Plesk also use log4j

cpanel server
Code (Text):
locate log4j-core
/home/cpanelsolr/contrib/prometheus-exporter/lib/log4j-core-2.13.2.jar
/home/cpanelsolr/licenses/log4j-core-2.13.2.jar.sha1
/home/cpanelsolr/licenses/log4j-core-LICENSE-ASL.txt
/home/cpanelsolr/licenses/log4j-core-NOTICE.txt
/home/cpanelsolr/server/lib/ext/log4j-core-2.13.2.jar
/usr/share/elasticsearch/lib/log4j-core-2.11.1.jar
plesk ubuntu
Code (Text):
locate log4j-core
/usr/share/elasticsearch/lib/log4j-core-2.11.1.jar
edit: my mistake Plesk doesn't use elasticsearch search, I had installed elasticsearch on this Plesk Ubuntu server as I was developing a Plesk server info diagnostic script which scans and collects all Plesk server/environment info for quick overview of a Plesk system resource usage/configurations

Matt · Dec 11, 2021

Yeah, none of the servers I set up have the solar search installed.

eva2000 · Dec 11, 2021

Matt said: ↑

Yeah, none of the servers I set up have the solar search installed.
Click to expand...

Interesting https://support.cpanel.net/hc/en-us/articles/360052296474-What-is-cpanelsolr-

cpanelsolr is the software that manages the Dovecot text searches for both Roundcube and Horde. This was added in cPanel version 64.
Click to expand...

Matt · Dec 11, 2021

Yeah, but it’s not installed by default, and I never install it.

eva2000 · Dec 11, 2021

Matt said: ↑

Yeah, but it’s not installed by default, and I never install it.
Click to expand...

Indeed. This was on a very long time client's cPanel server. Going to switch it off

eva2000 · Dec 11, 2021

Cloudflare WAF rules for protections against log4j exploits. Only triggering one of the CF WAF rules for me right now for past 72hrs

eva2000 · Dec 11, 2021

More news coverage

https://www.zdnet.com/article/secur...og4j-java-library-is-already-being-exploited/

https://blog.qualys.com/vulnerabili...g4j2-zero-day-exploited-in-the-wild-log4shell

‘The Internet Is on Fire’

Log4j zero-day "Log4Shell" arrives just in time to ruin your weekend

Exploits Swirling for Major Security Defect in Apache Log4j | SecurityWeek.Com

Log4Shell: RCE 0-day exploit found in log4j2, a popular Java logging package | LunaSec

https://www.randori.com/blog/cve-2021-44228/

https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j

buik · Dec 11, 2021

What I have not yet read in this topic but is of interest. The severity is critical.
Seems Apache Log4j is used alot as a dependency for example for Red Hat Openshift.

And that often underestimates an impact like this.
At first glance, you may think, oh, I or We won't use it.
But therein lies the danger. Log4j is often used as part of.

eva2000 · Dec 11, 2021

buik said: ↑

What I have not yet read in this topic but is of interest. The severity is critical.
Seems Apache Log4j is used alot as a dependency for example for Red Hat Openshift.

And that often underestimates an impact like this.
At first glance, you may think, oh, I or We won't use it.
But therein lies the danger. Log4j is often used as part of.
Click to expand...

Yeah Log4j is used in dependencies to other packages which folks might not be aware of i.e. cPanel's optional cpanelsolr and even Plesk control panel. Then there's Xenforo Enhanced search addon's Elasticsearch usage

That includes Minecraft servers too ‘The Internet Is on Fire’

All an attacker has to do to exploit the flaw is strategically send a malicious code string that eventually gets logged by Log4j version 2.0 or higher. The exploit lets an attacker load arbitrary Java code on a server, allowing them to take control.

“It's a design failure of catastrophic proportions,” says Free Wortley, CEO of the open source data security platform LunaSec. Researchers at the company published a warning and initial assessment of the Log4j vulnerability on Thursday.

Minecraft screenshots circulating on forums appear to show players exploiting the vulnerability from the Minecraft chat function. On Friday, some Twitter users began changing their display names to code strings that could trigger the exploit. Another user changed his iPhone name to do the same and submitted the finding to Apple. Researchers told WIRED that the approach could also potentially work using email.
Click to expand...

and

The situation underscores the challenges of managing risk within interdependent enterprise software. As Minecraft did, many organizations will need to develop their own patches or will be unable to patch immediately because they are running legacy software, like older versions of Java. Additionally, Log4j is not a casual thing to patch in live services because if something goes wrong an organization could compromise their logging capabilities at the moment when they need them most to watch for attempted exploitation.
Click to expand...

and Log4Shell: RCE 0-day exploit found in log4j2, a popular Java logging package | LunaSec

Who is impacted?
Many, many services are vulnerable to this exploit. Cloud services like Steam, Apple iCloud, and apps like Minecraft have already been found to be vulnerable.

Anybody using Apache Struts is likely vulnerable. We've seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach.

Many Open Source projects like the Minecraft server, Paper, have already begun patching their usage of log4j2.

Simply changing an iPhone's name has been shown to trigger the vulnerability in Apple's servers.
Click to expand...

buik · Dec 11, 2021

eva2000 said: ↑

‘The Internet Is on Fire’
Click to expand...

Pfffff ‘The Internet Is on Fire’, “It's a design failure of catastrophic proportions.”.
Was that article written by a snowflake who is afraid?

Come on. Of course you shouldn't do that.
Stay calm and keep an eye on your infra.
Once in a while you have a critical CVE. So what.

You don't have to insult the programmers involved to Apache with cries like
'design failure of catastrophic proportions'.
This writer knows it all better. Well, let's see then!

eva2000 · Dec 11, 2021

buik said: ↑

Pfffff ‘The Internet Is on Fire’, “It's a design failure of catastrophic proportions.”.
Was that article written by a snowflake who is afraid?
Click to expand...

with this day and age of security alerts everyday, sometimes an extra bit of fear is needed to push folks to act maybe?

eva2000 said: ↑

Cloudflare WAF rules for protections against log4j exploits. Only triggering one of the CF WAF rules for me right now for past 72
Click to expand...

Looks like even some of my custom Cloudflare Firewall rules caught the log4j attacker's IP address doing other things too

Matt · Dec 11, 2021

cpanel have already released a fix for dovcot-solr

New Thread - log4j CVE-2021-44228, does it affect Cpanel?

Log in / Register

Forums

Get the most out of your Centmin Mod LEMP stack

Security Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit (Log4Shell)

Revenge Active Member

Jimmy Well-Known Member

Rake-GH Active Member

Matt Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Matt Well-Known Member

eva2000 Administrator Staff Member

Matt Well-Known Member

eva2000 Administrator Staff Member

Matt Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

Matt Well-Known Member

.

Log in / Register

Useful Searches

Get the most out of your Centmin Mod LEMP stack

Security Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit (Log4Shell)

Revenge Active Member

Jimmy Well-Known Member

Rake-GH Active Member

Matt Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Matt Well-Known Member

eva2000 Administrator Staff Member

Matt Well-Known Member

eva2000 Administrator Staff Member

Matt Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

buik “The best traveler is one without a camera.”

eva2000 Administrator Staff Member

Matt Well-Known Member

.