Log4j Update: Patch Priority, Affected Versions and CVE-2021-44832
Summary
Wiz updates its Log4j guidance with CVE-2021-44832 details, patch priorities, affected-version advice, and ways to find vulnerable software. It urges fixing CVE-2021-44228 first because it is easier to exploit and actively exploited.
Key points
- Apache released Log4j 2.17.1 on December 28, 2021, to address CVE-2021-44832, which affects versions 2.0-alpha7 through 2.17.0, excluding 2.3.2 and 2.12.4.
- The article says CVE-2021-44832 has a severity rating of 6.6 and requires an attacker to be able to modify the Log4j configuration file.
- Wiz recommends prioritizing CVE-2021-44228 because it is easier to exploit and was being heavily exploited; it also advises prioritizing publicly exposed and highly privileged workloads.
- The article reports that 55% of workloads in organizations that had mitigated Log4j vulnerabilities were still vulnerable to Log4Shell as of December 21, 2021.
- Reported exploitation included Mirai variants, Kinsing, ransomware attempts, and nation-state activity tracked by Microsoft; the article attributes these reports to the named researchers and organizations.
- Suggested discovery approaches include scanning for log4j-core files, searching internally developed software for Log4j references, and consulting vendor and NCSC-NL affected-software lists.
- The article recommends upgrading to the latest applicable Log4j version and describes WAF rules and restricting outbound connections as temporary network-level mitigations.
Article Details
- Vulnerability Types
- Remote code execution
- Denial of service
- Severity
- CVE-2021-44832 is rated 6.6; the article describes the original Log4Shell vulnerability as 10/10 at disclosure and reports CVE-2021-44228 as critical.
- Affected Versions
- Apache Log4j 2.0-alpha7–2.17.0, excluding 2.3.2 and 2.12.4 (CVE-2021-44832)
- Apache Log4j versions lower than 2.15.0 (CVE-2021-44228)
- Apache Log4j 1.x with JMSAppender configured (CVE-2021-4104)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Use a network-level WAF to block common attacks while updating affected software.
- Prevent servers from initiating outbound connections to unknown or black-listed domains.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | 715de0e31919[.]bingsearchlib[.]com | Attacker-controlled LDAP host referenced in the Log4Shell payload example. |
MITRE ATT&CK
T1021 · Remote ServicesThe article reports ransomware groups leveraging Log4Shell for lateral movement.T1041 · Exfiltration Over C2 ChannelThe article identifies data leaks as a potential outcome of exploitation, but gives no specific exfiltration method.T1059 · Command and Scripting InterpreterThe article describes attacker-controlled JNDI lookups loading and executing code from a remote URL.T1105 · Ingress Tool TransferLog4j is instructed to retrieve an object from an attacker-controlled remote server.T1190 · Exploit Public-Facing ApplicationAttackers send crafted input to publicly exposed systems running vulnerable Log4j to exploit Log4Shell.T1210 · Exploitation of Remote ServicesThe article reports Log4Shell exploitation against vulnerable software and connected systems, including ransomware attempts involving Windows machines connected to compromised Minecraft servers.T1486 · Data Encrypted for ImpactThe article reports ransomware deployment attempts using Log4Shell.T1496 · Resource HijackingThe article reports Kinsing, which runs a cryptocurrency miner, exploiting Log4Shell.
CVE
CVE-2021-41041.x is not vulnerable to this attack? No, it might still be susceptible to a separately reported CVE-2021-4104 that, similarly to CVE-2021-44228, allows Remote Code Execution if your logging configuration hasCVE-2021-44228Therefore, Wiz recommends focusing on patching workloads vulnerable to CVE-2021-44228 (the original log4shell) first, as it's easier to exploit and heavily exploited in the wild.CVE-2021-44832December 28, 2021 update - CVE-2021-44832, a new Log4j vulnerability
Threat Actors
Malware
KinsingKinsing—Golang-based malware. It runs a cryptocurrency miner and attempts to spread itself to other hosts in the victim's environment.MiraiMirai—One of the most significant botnets targeting exposed networking devices running Linux. Several different variants of Mirai exploit Log4j vulnerabilities.
Vendors
ApacheOn December 28, 2021, Apache released new log4j version 2.17.1 to address CVE-2021-44832, a new remote code execution vulnerability affecting log4j 2.0-alpha7 - 2.17.0 excluding 2.3.2 and 2.12.4 versions. Wiz detectsWizcode execution vulnerability affecting log4j 2.0-alpha7 - 2.17.0 excluding 2.3.2 and 2.12.4 versions. Wiz detects CVE-2021-44832.
Products
Elasticthem. All types of software are affected: management software like vCenter, backend solutions like Elastic, Kafka, and even Minecraft. Locating and updating the software is crucial.KafkaAll types of software are affected: management software like vCenter, backend solutions like Elastic, Kafka, and even Minecraft. Locating and updating the software is crucial.Log4jDecember 28, 2021 update - CVE-2021-44832, a new Log4j vulnerabilityMinecraftdiscovered Log4Shell attempts to deploy ransomware on Windows machines connected to compromised Minecraft servers. The Microsoft Threat Intelligence Center (MSTIC) reported tracking multiple nation-stateVMware vCenter Serverand reported that Log4Shell impacted them. All types of software are affected: management software like vCenter, backend solutions like Elastic, Kafka, and even Minecraft. Locating and updating the software is crucial.
Tools
Countries
ChinaThreat Intelligence Center (MSTIC) reported tracking multiple nation-state activity originating from China, Iran, North Korea, and Turkey.IranIntelligence Center (MSTIC) reported tracking multiple nation-state activity originating from China, Iran, North Korea, and Turkey.North KoreaCenter (MSTIC) reported tracking multiple nation-state activity originating from China, Iran, North Korea, and Turkey.Turkey(MSTIC) reported tracking multiple nation-state activity originating from China, Iran, North Korea, and Turkey.