Huntress Urges Log4j 2.17.1 Upgrade Amid Active Log4Shell Exploitation
Summary
Huntress describes active exploitation of the critical Log4j vulnerability CVE-2021-44228, explains its JNDI-based attack path, and recommends upgrading to log4j 2.17.1 while vendors update affected products.
Key points
- A logged string in a vulnerable Log4j instance can trigger a JNDI lookup to an attacker-controlled location and lead to remote code execution.
- The article reports active exploitation and says the vulnerability affects software that bundles Log4j, including products from multiple vendors.
- Huntress recommends upgrading Log4j to 2.17.1, while noting that some organizations must wait for vendors to patch bundled components.
- The article says log4j 2.16.0 disabled JNDI by default and removed Message Lookups; 2.17.0 addressed DoS CVE-2021-45105, and 2.17.1 fixed a separate arbitrary-code-execution issue involving JNDI data sources.
- Huntress provided a testing tool that logs whether an application makes a test connection; a negative result does not guarantee the application is patched.
- Huntress reported that N-able confirmed affected RMM and N-Central products; Auvik and ConnectWise also shared information about potentially affected systems.
Article Details
- Vulnerability Types
- Remote code execution (RCE)
- Denial of service (DoS)
- Severity
- Critical
- Affected Versions
- log4j 2.16.0
- log4j 2.17.0
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1105 · Ingress Tool TransferThe article describes a first-stage endpoint redirecting the victim to an attacker-controlled endpoint that serves Java code.T1190 · Exploit Public-Facing ApplicationAttackers actively exploited the Log4j vulnerability by supplying JNDI-triggering text to vulnerable applications.
CVE
People
Caleb StewartHelped lead the effort to create the vulnerability-testing tool.Florian RothShared grep commands and YARA rules for detecting exploitation of CVE-2021-44228.Jason SlagleCo-created the Log4Shell vulnerability tool and helped lead the effort.John HammondHuntress researcher who recreated a proof-of-concept exploit against Minecraft servers and helped lead the vulnerability-testing tool effort.Robert FullerCollected hashes for vulnerable Log4j versions and file paths.Tom LawrenceInformed Huntress that the UniFi controller platform was vulnerable.
Vendors
Apacheaffecting a Java logging package log4j which is used in a significant amount of software, including Apache, Apple iCloud, Steam, Minecraft and others. Huntress is actively uncovering the effects of thisAuvikConnectWise Manage, Auvik and N-able may be impactedConnectWiseConnectWise Manage, Auvik and N-able may be impactedN-ableConnectWise Manage, Auvik and N-able may be impacted
Products
Apache SolrApache Struts, Solr and Druid)Apache StrutsApache Struts, Solr and Druid)ConnectWise ManageConnectWise Manage, Auvik and N-able may be impactedDruidApache Struts, Solr and Druid)Log4jHomeBlogCritical RCE Vulnerability: log4j - CVE-2021-44228Minecraftpackage log4j which is used in a significant amount of software, including Apache, Apple iCloud, Steam, Minecraft and others. Huntress is actively uncovering the effects of this vulnerability and will be frequentlyN-centraland concerns for ConnectWise Manage installations, and N-able has confirmed that their RMM and N-Central are affected.Redis Desktop ManagerRedis Desktop Manager (Redis proper is not affected)UniFi controller platformFellow MSP community member Tom Lawrence had confirmed and informed Huntress that the UniFi controller platform is vulnerable. If you use this technology, we urge you to upgrade to the patched version 6.5.54 as soon as