images
Blog

Log4j Vulnerability: Are Your Applications at Risk?

Dr. Eduardo Rocha, Senior Solutions Engineer & Security Analyst @ GlobalDots
21.02.2022
image 3 Min read

Why Should You Care?

Log4j vulnerability can affect vendors and services across the software industry. The IT community has received a shockwave following the Log4j security vulnerability announcement at the end of 2021. Apache Log4j is a popular logging utility used in various applications. As a result, the Federal Trade Commission (FTC) issued a warning that millions of consumer and enterprise products, web services, and applications are at risk.

That’s why CTOs, CISOs, DevOps Managers, and Project Leads need to understand the implications of this recent cybersecurity threat.

Log4j Is Everywhere!

Apache Log4j is a logging utility commonly used to log security and performance metrics for websites, applications, and IT services. Programmers can use Log4j to output logs and diagnostic information to various output targets without slowing down the applications. Developers can enable logging at runtime to debug problems. Due to the convenience and performance factors, Log4j has gained popularity among software companies worldwide.

Even businesses not using Log4j might have the utility present in third-party vendor applications and APIs. Companies like Adobe, AWS, Atlassian, Broadcom, Cisco, Citrix, Debian, Dockers, IBM, Microsoft, Oracle, Redhat, Ubuntu, VMWare, and more use Log4j in their products and services.

Log4j Vulnerability Explained

Apache received the first Log4j vulnerability report from a security engineer from Alibaba on November 24, 2021. Cybercriminals can exploit the vulnerability, published as CVE-2021-44228 and known as “Log4Shell”, to manipulate log messages or use log message parameters to execute malicious code loaded from LDAP servers when message lookup substitution is enabled. The vulnerability received a Common Vulnerability Scoring System (CVSS) base score of 10.0, the highest severity level.

Unfortunately, the message lookup substitution is enabled by default for Apache Log4j2 2.0-beta9 to 2.14.1. From Log4j 2.15.0, the message lookup substitution is disabled by default. From Log4j 2.16.0, the functionality has been completely removed.

Cyberattackers can exploit the Log4j vulnerability for unauthenticated, remote code execution (RCE) when a vulnerable version of the Log4j library is present in an application. They can use a single text string to trigger the software to contact external hosts, download a malicious payload and execute it locally. Cybercriminals are already using Log4j exploits for credential theft, data exfiltration, crypto mining, distributed denial of service (DDoS) attacks, and malware deployment.

Apache has been addressing the issues concerning the Log4j vulnerability. Here is a summary of the related CVE publications and resolutions:

VulnerabilityCVSS ScoreSecurity ThreatFixed Version
CVE-2021-4422810A remote code execution (RCE) vulnerability affecting Log4j versions from 2.0-beta9 to 2.14.12.15.0
CVE-2021-450469A data leak and remote code execution (RCE) vulnerability affecting Log4j versions from 2.0-beta9 to 2.15.0, excluding 2.12.22.16.0
CVE-2021-451055.9 A denial-of-service (DoS) vulnerability affecting Log4j versions from 2.0-alpha1 to 2.16.02.17.0
CVE-2021-448326.6 A vulnerability to remote code execution via JDBC Appender when attacker controls configuration affecting Log4j2 versions 2.0-beta7 through 2.17.02.17.1

Log4j Vulnerability Is a Cybersecurity Imperative

Like most modern businesses, your organization probably uses software applications, tools, and APIs from multiple vendors. Due to the popularity of the Log4j library, the probability of your systems having exposure to the Log4j vulnerability is high. You should prepare your systems through understanding your application stack, improving access control, and updating relevant libraries to enhance application and API security. Learn how our leading partners help you defend against Log4j vulnerability here.

Early detection and remediation of the Log4j vulnerability is a time-sensitive issue for many organizations. If you need to quickly mitigate the risk associated with Log4j, an experienced web technology partner who has expertise in mitigating cybersecurity threats can speed up the process.

At GlobalDots, our web security consultants can help with risk assessment and mitigation for cybersecurity threats like the Log4j vulnerability. To learn more about our security services, contact GlobalDots today.

Comments

0 comments

There’s more to see

How Separating Data & Network Security Protects Your Supply Chain
Supply-Chain Data Protection
Dr. Eduardo Rocha, Senior Solutions Engineer & Security Analyst @ GlobalDots 09.05.22

Software supply chain security is an enormous concern for businesses today. According to a 2021 Argon cybersecurity report, software supply chain attacks increased threefold in 2021 compared to the previous year.  The constant race of companies to do things faster while delivering a better, richer user experience adds a multitude of vulnerabilities to the supply […]

Read more
SASE vs. SD-WAN: A Quick Guide
SD-WAN and SASE
Miguel Fersen, Senior Cloud Consultant @ GlobalDots

New technologies have a wicked tendency to pile up. With cloud solution categories now emerging on a weekly basis, the result of bringing them into your estate is usually more complexity and confusion. But sometimes, a single new technology allows us to rid a bunch of old ones in a snap. SASE pretends to be […]

Read more
Old Dogs, New Tricks: Innovating with CDNs
Content Delivery Network (CDN)
Dror Arie, Senior Solutions Architect @ GlobalDots 20.04.22

Today’s digital businesses with global customers cannot afford slow page loads and applications caused by physical distance and latency issues. Page load speeds can have a significant effect on customer acquisition and retention. Walmart discovered that a 1% increase in page load time results in a 2% increase in conversion rates. So businesses are using […]

Read more
Unlock Your Cloud Potential
Schedule a call with our experts. Discover new technology and get recommendations to improve your performance.
Contact us