Advisory details:
github_osv / GHSA-jfh8-c2jp-5v3q
| Advisory ID | github_osv/GHSA-jfh8-c2jp-5v3q |
| Aliases |
CVE-2021-44228
|
| Summary | Remote code injection in Log4j # Summary Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser. As per [Apache's Log4j security guide](https://logging.apache.org/log4j/2.x/security.html): Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default. Log4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the `Updated advice for version 2.16.0` section of this advisory. # Impact Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input. # Affected versions Any Log4J version prior to v2.15.0 is affected to this specific issue. The v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible. ## Security releases Additional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3 ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Remediation Advice ## Updated advice for version 2.16.0 The Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which [disables JNDI by default and completely removes support for message lookups](https://logging.apache.org/log4j/2.x/changes-report.html#a2.16.0). Even in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046). More information is available on the [GitHub Security Advisory for CVE-2021-45046](https://github.com/advisories/GHSA-7rjr-3q55-vv33). Users who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must [ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded](https://issues.apache.org/jira/browse/LOG4J2-3221). Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 9.0 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 10.0 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json |
| generic_textual | CRITICAL |
| Data source | Exploit-DB |
|---|---|
| Date added | April 1, 2023 |
| Description | AD Manager Plus 7122 - Remote Code Execution (RCE) |
| Ransomware campaign use | Unknown |
| Source publication date | April 1, 2023 |
| Exploit type | remote |
| Platform | java |
| Source update date | April 1, 2023 |
| Data source | Metasploit |
|---|---|
| Description | MobileIron Core is affected by the Log4Shell vulnerability whereby a JNDI string sent to the server will cause it to connect to the attacker and deserialize a malicious Java object. This results in OS command execution in the context of the tomcat user. This module will start an LDAP server that the target will need to connect to. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: - repeatable-session RelatedModules: - auxiliary/scanner/http/log4shell_scanner - exploit/multi/http/log4shell_header_injection |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 12, 2021 |
| Platform | Unix |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/http/mobileiron_core_log4shell.rb |
| Data source | KEV |
|---|---|
| Date added | Dec. 10, 2021 |
| Description | Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. |
| Required action | For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available. |
| Due date | Dec. 24, 2021 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2021-44228 |
| Ransomware campaign use | Known |
| Data source | Metasploit |
|---|---|
| Description | The Ubiquiti UniFi Network Application versions 5.13.29 through 6.5.53 are affected by the Log4Shell vulnerability whereby a JNDI string can be sent to the server via the 'remember' field of a POST request to the /api/login endpoint that will cause the server to connect to the attacker and deserialize a malicious Java object. This results in OS command execution in the context of the server application. This module will start an LDAP server that the target will need to connect to. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: - repeatable-session |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 9, 2021 |
| Platform | Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/ubiquiti_unifi_log4shell.rb |
| Data source | Metasploit |
|---|---|
| Description | VMware vCenter Server is affected by the Log4Shell vulnerability whereby a JNDI string can sent to the server that will cause it to connect to the attacker and deserialize a malicious Java object. This results in OS command execution in the context of the root user in the case of the Linux virtual appliance and SYSTEM on Windows. This module will start an LDAP server that the target will need to connect to. This exploit uses the logon page vector. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: - repeatable-session RelatedModules: - auxiliary/scanner/http/log4shell_scanner - exploit/multi/http/log4shell_header_injection |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 9, 2021 |
| Platform | Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/vmware_vcenter_log4shell.rb |
| Data source | Metasploit |
|---|---|
| Description | Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will scan an HTTP end point for the Log4Shell vulnerability by injecting a format message that will trigger an LDAP connection to Metasploit. This module is a generic scanner and is only capable of identifying instances that are vulnerable via one of the pre-determined HTTP request injection points. These points include HTTP headers and the HTTP request path. Known impacted software includes Apache Struts 2, VMWare VCenter, Apache James, Apache Solr, Apache Druid, Apache JSPWiki, Apache OFBiz. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 9, 2021 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/http/log4shell_scanner.rb |
| Data source | Metasploit |
|---|---|
| Description | Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will exploit an HTTP end point with the Log4Shell vulnerability by injecting a format message that will trigger an LDAP connection to Metasploit and load a payload. The Automatic target delivers a Java payload using remote class loading. This requires Metasploit to run an HTTP server in addition to the LDAP server that the target can connect to. The targeted application must have the trusted code base option enabled for this technique to work. The non-Automatic targets deliver a payload via a serialized Java object. This does not require Metasploit to run an HTTP server and instead leverages the LDAP server to deliver the serialized object. The target application in this case must be compatible with the user-specified JAVA_GADGET_CHAIN option. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: - repeatable-session RelatedModules: - auxiliary/scanner/http/log4shell_scanner |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 9, 2021 |
| Platform | Java,Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/log4shell_header_injection.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:25:34Z/
Decision: Act
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2021/44xxx/CVE-2021-44228.json
Source Advisory: vulnrichment/CVE-2021-44228
[{'Exploitation': 'active'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]