Why Should You Care?
Log4j vulnerability can affect vendors and services across the software industry. The IT community has received a shockwave following the Log4j security vulnerability announcement at the end of 2021. Apache Log4j is a popular logging utility used in various applications. As a result, the Federal Trade Commission (FTC) issued a warning that millions of consumer and enterprise products, web services, and applications are at risk.
That’s why CTOs, CISOs, DevOps Managers, and Project Leads need to understand the implications of this recent cybersecurity threat.
How One AI-Driven Media Platform Cut EBS Costs for AWS ASGs by 48%
Log4j Is Everywhere!
Apache Log4j is a logging utility commonly used to log security and performance metrics for websites, applications, and IT services. Programmers can use Log4j to output logs and diagnostic information to various output targets without slowing down the applications. Developers can enable logging at runtime to debug problems. Due to the convenience and performance factors, Log4j has gained popularity among software companies worldwide.
Even businesses not using Log4j might have the utility present in third-party vendor applications and APIs. Companies like Adobe, AWS, Atlassian, Broadcom, Cisco, Citrix, Debian, Dockers, IBM, Microsoft, Oracle, Redhat, Ubuntu, VMWare, and more use Log4j in their products and services.
Log4j Vulnerability Explained
Apache received the first Log4j vulnerability report from a security engineer from Alibaba on November 24, 2021. Cybercriminals can exploit the vulnerability, published as CVE-2021-44228 and known as “Log4Shell”, to manipulate log messages or use log message parameters to execute malicious code loaded from LDAP servers when message lookup substitution is enabled. The vulnerability received a Common Vulnerability Scoring System (CVSS) base score of 10.0, the highest severity level.
Unfortunately, the message lookup substitution is enabled by default for Apache Log4j2 2.0-beta9 to 2.14.1. From Log4j 2.15.0, the message lookup substitution is disabled by default. From Log4j 2.16.0, the functionality has been completely removed.
Cyberattackers can exploit the Log4j vulnerability for unauthenticated, remote code execution (RCE) when a vulnerable version of the Log4j library is present in an application. They can use a single text string to trigger the software to contact external hosts, download a malicious payload and execute it locally. Cybercriminals are already using Log4j exploits for credential theft, data exfiltration, crypto mining, distributed denial of service (DDoS) attacks, and malware deployment.
Apache has been addressing the issues concerning the Log4j vulnerability. Here is a summary of the related CVE publications and resolutions:
| Vulnerability | CVSS Score | Security Threat | Fixed Version |
| CVE-2021-44228 | 10 | A remote code execution (RCE) vulnerability affecting Log4j versions from 2.0-beta9 to 2.14.1 | 2.15.0 |
| CVE-2021-45046 | 9 | A data leak and remote code execution (RCE) vulnerability affecting Log4j versions from 2.0-beta9 to 2.15.0, excluding 2.12.2 | 2.16.0 |
| CVE-2021-45105 | 5.9 | A denial-of-service (DoS) vulnerability affecting Log4j versions from 2.0-alpha1 to 2.16.0 | 2.17.0 |
| CVE-2021-44832 | 6.6 | A vulnerability to remote code execution via JDBC Appender when attacker controls configuration affecting Log4j2 versions 2.0-beta7 through 2.17.0 | 2.17.1 |
Log4j Vulnerability Is a Cybersecurity Imperative
Like most modern businesses, your organization probably uses software applications, tools, and APIs from multiple vendors. Due to the popularity of the Log4j library, the probability of your systems having exposure to the Log4j vulnerability is high. You should prepare your systems through understanding your application stack, improving access control, and updating relevant libraries to enhance application and API security. Learn how our leading partners help you defend against Log4j vulnerability here.
Early detection and remediation of the Log4j vulnerability is a time-sensitive issue for many organizations. If you need to quickly mitigate the risk associated with Log4j, an experienced web technology partner who has expertise in mitigating cybersecurity threats can speed up the process.
At GlobalDots, our web security consultants can help with risk assessment and mitigation for cybersecurity threats like the Log4j vulnerability. To learn more about our security services, contact GlobalDots today.
