Home Resources Blog Log4j Vulnerability: Are Your Applications at Risk?

Log4j Vulnerability: Are Your Applications at Risk?

Dr. Eduardo Rocha, Senior Solutions Engineer & Security Analyst @ GlobalDots
21.02.2022
image 3 Min read

Why Should You Care?

Log4j vulnerability can affect vendors and services across the software industry. The IT community has received a shockwave following the Log4j security vulnerability announcement at the end of 2021. Apache Log4j is a popular logging utility used in various applications. As a result, the Federal Trade Commission (FTC) issued a warning that millions of consumer and enterprise products, web services, and applications are at risk.

That’s why CTOs, CISOs, DevOps Managers, and Project Leads need to understand the implications of this recent cybersecurity threat.

Log4j Is Everywhere!

Apache Log4j is a logging utility commonly used to log security and performance metrics for websites, applications, and IT services. Programmers can use Log4j to output logs and diagnostic information to various output targets without slowing down the applications. Developers can enable logging at runtime to debug problems. Due to the convenience and performance factors, Log4j has gained popularity among software companies worldwide.

Even businesses not using Log4j might have the utility present in third-party vendor applications and APIs. Companies like Adobe, AWS, Atlassian, Broadcom, Cisco, Citrix, Debian, Dockers, IBM, Microsoft, Oracle, Redhat, Ubuntu, VMWare, and more use Log4j in their products and services.

Log4j Vulnerability Explained

Apache received the first Log4j vulnerability report from a security engineer from Alibaba on November 24, 2021. Cybercriminals can exploit the vulnerability, published as CVE-2021-44228 and known as “Log4Shell”, to manipulate log messages or use log message parameters to execute malicious code loaded from LDAP servers when message lookup substitution is enabled. The vulnerability received a Common Vulnerability Scoring System (CVSS) base score of 10.0, the highest severity level.

Unfortunately, the message lookup substitution is enabled by default for Apache Log4j2 2.0-beta9 to 2.14.1. From Log4j 2.15.0, the message lookup substitution is disabled by default. From Log4j 2.16.0, the functionality has been completely removed.

Cyberattackers can exploit the Log4j vulnerability for unauthenticated, remote code execution (RCE) when a vulnerable version of the Log4j library is present in an application. They can use a single text string to trigger the software to contact external hosts, download a malicious payload and execute it locally. Cybercriminals are already using Log4j exploits for credential theft, data exfiltration, crypto mining, distributed denial of service (DDoS) attacks, and malware deployment.

Apache has been addressing the issues concerning the Log4j vulnerability. Here is a summary of the related CVE publications and resolutions:

VulnerabilityCVSS ScoreSecurity ThreatFixed Version
CVE-2021-4422810A remote code execution (RCE) vulnerability affecting Log4j versions from 2.0-beta9 to 2.14.12.15.0
CVE-2021-450469A data leak and remote code execution (RCE) vulnerability affecting Log4j versions from 2.0-beta9 to 2.15.0, excluding 2.12.22.16.0
CVE-2021-451055.9 A denial-of-service (DoS) vulnerability affecting Log4j versions from 2.0-alpha1 to 2.16.02.17.0
CVE-2021-448326.6 A vulnerability to remote code execution via JDBC Appender when attacker controls configuration affecting Log4j2 versions 2.0-beta7 through 2.17.02.17.1

Log4j Vulnerability Is a Cybersecurity Imperative

Like most modern businesses, your organization probably uses software applications, tools, and APIs from multiple vendors. Due to the popularity of the Log4j library, the probability of your systems having exposure to the Log4j vulnerability is high. You should prepare your systems through understanding your application stack, improving access control, and updating relevant libraries to enhance application and API security. Learn how our leading partners help you defend against Log4j vulnerability here.

Early detection and remediation of the Log4j vulnerability is a time-sensitive issue for many organizations. If you need to quickly mitigate the risk associated with Log4j, an experienced web technology partner who has expertise in mitigating cybersecurity threats can speed up the process.

At GlobalDots, our web security consultants can help with risk assessment and mitigation for cybersecurity threats like the Log4j vulnerability. To learn more about our security services, contact GlobalDots today.

Read More

Inform every aspect of your product & business with CDN Monitoring
Monitoring, Logging & Observability
Snir Ambar, Head of AI & Innovation @ GlobalDots 22.09.22

Extract actionable real-time insights, optimize performance and identify issues before they become problems – by unlocking the hidden value of CDN logs! Get 14 days free access to all features right now.

Watch more
Cybersecurity takes center stage
DevOps as a Service
Artem Mescheryakov, Senior DevOps Engineer, GlobalDots 20.09.22

In recognition of National Coding Week, Geektime.com, a top media channel covering tech, startup, venture capital, internet, mobile, development and more – featured a guest post by Artem Mescheryakov, Senior DevOps Engineer at GlobalDots:  “National Coding Week is about learning the value and importance of digital skills as well as nurturing the increasingly important skill of coding. Developer shortages […]

Read more
A CISO’s Essential Guide to API Security
API Security
Admin Globaldots 15.09.22

Learn how to reduce the business risk of API attacks – and maximize the value of digital innovation.  APIs are the entry point to your organization’s most critical data and services. Their protection is crucial to reduce risks, maximize program value, and generate growth. In this guide, we take a close look at the special […]

Read more
Unlock Your Cloud Potential
Schedule a call with our experts. Discover new technology and get recommendations to improve your performance.
Book a Demo