Advisory details:
vulnrichment / CVE-2021-44228
| Advisory ID | vulnrichment/CVE-2021-44228 |
| Aliases | |
| Summary | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-20 | Improper Input Validation |
| CWE-400 | Uncontrolled Resource Consumption |
| CWE-502 | Deserialization of Untrusted Data |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 10 | |
| ssvc | Act |
| Data source | KEV |
|---|---|
| Date added | Dec. 10, 2021 |
| Description | Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. |
| Required action | For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available. |
| Due date | Dec. 24, 2021 |
| Note | https://nvd.nist.gov/vuln/detail/CVE-2021-44228 |
| Ransomware campaign use | Known |
| Data source | Metasploit |
|---|---|
| Description | Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will scan an HTTP end point for the Log4Shell vulnerability by injecting a format message that will trigger an LDAP connection to Metasploit. This module is a generic scanner and is only capable of identifying instances that are vulnerable via one of the pre-determined HTTP request injection points. These points include HTTP headers and the HTTP request path. Known impacted software includes Apache Struts 2, VMWare VCenter, Apache James, Apache Solr, Apache Druid, Apache JSPWiki, Apache OFBiz. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 9, 2021 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/http/log4shell_scanner.rb |
| Data source | Metasploit |
|---|---|
| Description | Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will exploit an HTTP end point with the Log4Shell vulnerability by injecting a format message that will trigger an LDAP connection to Metasploit and load a payload. The Automatic target delivers a Java payload using remote class loading. This requires Metasploit to run an HTTP server in addition to the LDAP server that the target can connect to. The targeted application must have the trusted code base option enabled for this technique to work. The non-Automatic targets deliver a payload via a serialized Java object. This does not require Metasploit to run an HTTP server and instead leverages the LDAP server to deliver the serialized object. The target application in this case must be compatible with the user-specified JAVA_GADGET_CHAIN option. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: - repeatable-session RelatedModules: - auxiliary/scanner/http/log4shell_scanner |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 9, 2021 |
| Platform | Java,Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/log4shell_header_injection.rb |
| Data source | Metasploit |
|---|---|
| Description | The Ubiquiti UniFi Network Application versions 5.13.29 through 6.5.53 are affected by the Log4Shell vulnerability whereby a JNDI string can be sent to the server via the 'remember' field of a POST request to the /api/login endpoint that will cause the server to connect to the attacker and deserialize a malicious Java object. This results in OS command execution in the context of the server application. This module will start an LDAP server that the target will need to connect to. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: - repeatable-session |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 9, 2021 |
| Platform | Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/ubiquiti_unifi_log4shell.rb |
| Data source | Metasploit |
|---|---|
| Description | VMware vCenter Server is affected by the Log4Shell vulnerability whereby a JNDI string can sent to the server that will cause it to connect to the attacker and deserialize a malicious Java object. This results in OS command execution in the context of the root user in the case of the Linux virtual appliance and SYSTEM on Windows. This module will start an LDAP server that the target will need to connect to. This exploit uses the logon page vector. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: - repeatable-session RelatedModules: - auxiliary/scanner/http/log4shell_scanner - exploit/multi/http/log4shell_header_injection |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 9, 2021 |
| Platform | Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/vmware_vcenter_log4shell.rb |
| Data source | Exploit-DB |
|---|---|
| Date added | April 1, 2023 |
| Description | AD Manager Plus 7122 - Remote Code Execution (RCE) |
| Ransomware campaign use | Unknown |
| Source publication date | April 1, 2023 |
| Exploit type | remote |
| Platform | java |
| Source update date | April 1, 2023 |
| Data source | Metasploit |
|---|---|
| Description | MobileIron Core is affected by the Log4Shell vulnerability whereby a JNDI string sent to the server will cause it to connect to the attacker and deserialize a malicious Java object. This results in OS command execution in the context of the tomcat user. This module will start an LDAP server that the target will need to connect to. |
| Note | Stability: - crash-safe SideEffects: - ioc-in-logs AKA: - Log4Shell - LogJam Reliability: - repeatable-session RelatedModules: - auxiliary/scanner/http/log4shell_scanner - exploit/multi/http/log4shell_header_injection |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 12, 2021 |
| Platform | Unix |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/http/mobileiron_core_log4shell.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-04T14:25:34Z/
Decision: Act
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2021/44xxx/CVE-2021-44228.json
Source Advisory: vulnrichment/CVE-2021-44228
[{'Exploitation': 'active'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]