Log4Shell: How the Log4j Vulnerability Enables Remote Code Execution and How to Mitigate It
Summary
The article explains how Log4Shell (CVE-2021-44228) can enable remote code execution through vulnerable Log4j, notes reported exploitation and broad exposure, and recommends finding affected applications and upgrading or applying a temporary workaround.
Key points
- The article describes Log4Shell as a critical remote code execution vulnerability triggered when Log4j logs attacker-controlled input that invokes JNDI.
- It says Log4j 2 versions earlier than 2.15.0 are affected through the LDAP JNDI parser.
- Wiz reported that more than 89% of environments it examined had vulnerable Log4j libraries; the article also said exploitation was occurring in the wild.
- The article recommends inventorying Log4j across VMs, containers, serverless workloads, and applications that embed the library.
- It recommends upgrading to Log4j 2.15.0 or later; for versions 2.10.0 and above, it gives `-Dlog4j2.formatMsgNoLookups=True` as a temporary workaround when an immediate upgrade is not possible.
- The article notes that the attack can be triggered through application activity and may affect internal servers, not only internet-facing systems.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical
- Affected Versions
- Log4j2 versions prior to 2.15.0
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For Log4j versions 2.10.0 and above, run the server with -Dlog4j2.formatMsgNoLookups=True.
MITRE ATT&CK
T1059.007 · JavaScriptThe article describes attackers injecting a Java class payload and executing Java code on the vulnerable logging server.T1190 · Exploit Public-Facing ApplicationAttackers exploit Log4Shell through network requests containing a malicious payload to reach vulnerable applications.
CVE
People
Vendors
Products
Log4jto contain the fallout from a critical vulnerability in the widely-used, open source logging library Log4j. The vulnerability, called Log4Shell, affects a huge number of ubiquitous apps, websites, and services,Wiz Security GraphAdditionally, customers can use the Wiz Security Graph to focus remediation effort on the workloads that are at greatest risk (e.g. workloads that are effectively exposed to the internet or ones that have access toWiz Threat Centerremediation guidance. You can get an immediate overview of your risk posture by logging into the Wiz Threat Center. For additional threat analysis, we recommend you visit the documentation for our Log4shell