{"id":18752,"date":"2021-12-15T08:49:33","date_gmt":"2021-12-15T08:49:33","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=18752"},"modified":"2026-04-17T18:07:45","modified_gmt":"2026-04-17T18:07:45","slug":"apachelog4j-remote-code-execution-vulnerability-cve-2021-44228-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/apachelog4j-remote-code-execution-vulnerability-cve-2021-44228-threat-alert\/","title":{"rendered":"ApacheLog4j Remote Code Execution Vulnerability (CVE-2021-44228) Threat Alert"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

On December 9 2021, NSFOCUS CRET has detected the disclosure of Apachelog4j Remote Code Execution Vulnerability (CVE-2021-44228). Due to the recursive parsing of some functions of apachelog4j2, unauthenticated attackers can execute arbitrary code on target servers by sending a specially constructed data request packet. The vulnerability PoC has been disclosed on the Internet and can be exploited with default configuration. As the vulnerability has a wide range of effects, NSFOCUS strongly recommends that users take measures to troubleshoot and prevent it as soon as possible.<\/p>\n\n\n\n

On December 10, NSFOCUS CERT found that for ApacheLog4j2.15.0-rc1 version, only LDAP was patched and host whitelist was added, which can be bypassed in non-default configurations. Thus, ApacheLog4j2.15.0-rc2 (the same as the stable version 2.15.0) was officially released to handle urI exceptions.<\/p>\n\n\n\n

On December 12, ApacheLog4j2.15.1-rc1 was officially released, which directly disabled the JNDI function. If the lookup function is required, it is recommended to upgrade to this version and manually set log4j2.formatMsgNoLookups to false as default.<\/p>\n\n\n\n

On December 13, Apache Log4j 2.16.0-rc1 (the same as the stable version 2.16.0) was officially released, which completely removes the vulnerable Message lookups function based on Apache Log4j 2.15.1-rc1.<\/p>\n\n\n\n

On December 14, Apache Log4j 2.12.2-rc1 was released. JNDI and Lookup functions are disabled by default, and Java 7 is supported.<\/p>\n\n\n\n

Apache Log4j2 is an open source Java logging framework and widely used in middleware, development framework and web applications to record log information.<\/p>\n\n\n\n

Screenshot of recurrence of vulnerability:<\/p>\n\n\n\n

\"Red<\/a><\/figure>\n\n\n\n

Screenshot of recurrence of Log4j 2.15.0-rc1 bypass:<\/p>\n\n\n\n

\"Red<\/a><\/figure>\n\n\n\n
Vulnerability details<\/strong><\/td>Vulnerability <\/strong>PoC<\/strong><\/td>Vulnerability <\/strong>EXP<\/strong><\/td>Use out of office<\/strong><\/td><\/tr>
Published<\/strong><\/strong><\/td>Published<\/strong><\/strong><\/td>Published<\/strong><\/strong><\/td>exist<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Reference link: https:\/\/issues.apache.org\/jira\/projects\/LOG4J2\/issues\/LOG4J2-3201?filter=allissues<\/a><\/p>\n\n\n\n

Scope of impact<\/h2>\n\n\n\n

Affected version<\/strong><\/p>\n\n\n\n