Apache Log4j 2 Vulnerability – What You Need to Know?

What is Vulnerability, and Why is it Challenging?

Log4j is a logging library found in many Java applications, and the vulnerability is a result of how Log4j processes log messages.

It allows the use of “lookup” features, where the user providing data to be logged can indicate where the content of the data comes from. For example, it can be a call to a remote server instead of a simple string. That lets attackers to inject calls to malicious servers that host malware or instruction to leak sensitive information (access tokens) to attacker-controlled servers.

These remote calls are enabled by a Java feature called Java Naming and Directory Interface (JNDI), which supports protocols such as the Lightweight Directory Access Protocol (LDAP), Domain Name System (DNS), Remote Method Invocation (RMI), and Common Object Request Broker Architecture (CORBA). Technically, an exploit is a string of the form ${jndi::} that an attacker must inject into a vulnerable log4j instance.

Many Internet-facing machines, such as web servers, accept user input that is logged by a backend running Log4j without sanitization. That often happens even if the webserver itself does not run Log4j, but some business applications use information from the user via the webserver. This allows attackers to inject the malicious strings via HTTP requests, for instance, which is the biggest attack surface observed so far.

There are two complex factors for this vulnerability. First, Log4j is not a single vulnerable application but an extensively used component in products ranging from databases to web conferencing systems. Thus, identifying vulnerable assets in a network is tricky. Next, attackers find many ways to conceal exploits, so understanding if and how your organization is or was attacked is not easy.