Apache Log4j 2.15.0 Incomplete Fix CVE-2021-44228 deserialization

Summaryinfo

A vulnerability marked as critical has been reported in Apache Log4j 2.15.0. Affected by this vulnerability is an unknown functionality of the component Incomplete Fix CVE-2021-44228. Performing a manipulation results in deserialization. This vulnerability is cataloged as CVE-2021-45046. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Apache Log4j 2.15.0. This affects an unknown code of the component Incomplete Fix CVE-2021-44228. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on availability. The summary by CVE is:

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

The weakness was shared 12/14/2021. It is possible to read the advisory at openwall.com. This vulnerability is uniquely identified as CVE-2021-45046. Technical details are unknown but a public exploit is available.

The exploit is shared for download at packetstormsecurity.com. It is declared as attacked. We expect the 0-day to have been worth approximately $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 216682 (RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 (RHSA-2025:1746)), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 05/01/2023 with a due date of 05/22/2023:

Apply updates per vendor instructions.

Upgrading to version 2.16.0 eliminates this vulnerability. The upgrade is hosted for download at logging.apache.org.

The vulnerability is also documented in the vulnerability database at Tenable (216682). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Log4j

Version

• 2.15.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion