Huntress Warns of Active Log4j RCE Exploitation and Recommends Version 2.17.1
Summary
Huntress reported active exploitation of Log4Shell (CVE-2021-44228), explained its JNDI-based RCE path, and advised updating Log4j to 2.17.1. It warned that bundled software may depend on vendor updates and that a negative test result does not guarantee patching.
Key points
- The article reported active exploitation of CVE-2021-44228, which affects the Java logging library Log4j and can enable remote code execution.
- A crafted string in logged input can trigger a vulnerable Log4j instance to make a JNDI request and retrieve attacker-controlled code.
- Huntress described a Minecraft server proof of concept in which a single chat message could trigger code execution on players' machines.
- GreyNoise was monitoring exploitation from more than 100 hosts at the time of writing; the article also noted payloads using JNDI DNS as well as LDAP.
- Huntress recommended Log4j 2.17.1 and warned that software bundling Log4j may require vendors to issue their own updates. It also identified UniFi Controller 6.5.54 as a patched version, based on information shared with Huntress by an MSP community member.
- The update said Log4j 2.17.1 limits JNDI data source names to the Java protocol to fix an arbitrary-code-execution issue in 2.17.0; earlier updates covered the DoS vulnerability CVE-2021-45105 and Log4j 2.16.0.
- Huntress offered a testing tool, but cautioned that a negative result does not guarantee an application is patched.
Article Details
- Vulnerability Types
- Remote code execution
- Denial of service
- Arbitrary code execution
- Severity
- Critical
- Affected Versions
- log4j 2.16.0
- log4j 2.17.0
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- partial
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article says commands in JNDIExploit URLs are typically Base64-encoded.T1105 · Ingress Tool TransferThe described attack uses a first-stage endpoint to direct the victim to an attacker-controlled endpoint serving Java code.T1190 · Exploit Public-Facing ApplicationAttackers can trigger the vulnerability by sending crafted text in an HTTP User-Agent header or POST form to an application using vulnerable log4j.
CVE
CVE-2021-44228Our team is investigating CVE-2021-44228, a critical vulnerability that’s affecting a Java logging package log4j which is used in a significant amount of software, including Apache, Apple iCloud, Steam, Minecraft andCVE-2021-45105Update #6 - 12/20/2021 @ 12:30pm ET - Updated with details to remediate DoS CVE-2021-45105 which was present in 2.16.0
People
Caleb StewartHelped lead the effort to create Huntress's vulnerability-testing tool.Florian RothSecurity researcher who shared grep commands and YARA rules for detecting CVE-2021-44228 exploitation.Jason SlagleCo-creator of Huntress's Log4Shell vulnerability tool.John HammondHuntress researcher who recreated a proof-of-concept exploit against Minecraft servers.Robert FullerCollected hashes for vulnerable log4j versions and file paths.Tom LawrenceMSP community member who confirmed and informed Huntress that the UniFi controller platform was vulnerable.
Vendors
Products
ConnectWise ManageConnectWise Manage, Auvik and N-able may be impactedLog4jOur team is investigating CVE-2021-44228, a critical vulnerability that’s affecting a Java logging package log4j which is used in a significant amount of software, including Apache, Apple iCloud, Steam, Minecraft andMinecraftpackage log4j which is used in a significant amount of software, including Apache, Apple iCloud, Steam, Minecraft and others. Huntress is actively uncovering the effects of this vulnerability and will be frequentlyN-centraland concerns for ConnectWise Manage installations, and N-able has confirmed that their RMM and N-Central are affected.UniFi controllerFellow MSP community member Tom Lawrence had confirmed and informed Huntress that the UniFi controller platform is vulnerable. If you use this technology, we urge you to upgrade to the patched version 6.5.54 as soon as