{"id":18784,"date":"2021-12-20T08:27:00","date_gmt":"2021-12-20T08:27:00","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=18784"},"modified":"2026-04-17T18:07:45","modified_gmt":"2026-04-17T18:07:45","slug":"apachelog4j-remote-code-execution-vulnerability-cve-2021-44228-threat-alert-2","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/apachelog4j-remote-code-execution-vulnerability-cve-2021-44228-threat-alert-2\/","title":{"rendered":"ApacheLog4j Remote Code Execution Vulnerability (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) Threat Alert updated on Dec 20 2021"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

The update involves (CVE-2021-45046) and (CVE-2021-45105) vulnerability information, scope of influence, product rules, official version and workaround.<\/p>\n\n\n\n

On December 9 2021, NSFOCUS CRET has detected the disclosure of Apachelog4j Remote Code Execution Vulnerability (CVE-2021-44228). Due to the recursive parsing of some functions of apachelog4j2, unauthenticated attackers can execute arbitrary code on target servers by sending a specially constructed data request packet. The vulnerability PoC has been disclosed on the Internet and can be exploited with default configuration. As the vulnerability has a wide range of effects, NSFOCUS strongly recommends that users take measures to troubleshoot and prevent it as soon as possible.<\/p>\n\n\n\n

On December 10, NSFOCUS CERT found that for ApacheLog4j2.15.0-rc1 version, only LDAP was patched and host whitelist was added, which can be bypassed in non-default configurations. Thus, ApacheLog4j2.15.0-rc2 (the same as the stable version 2.15.0) was officially released to handle urI exceptions.<\/p>\n\n\n\n

On December 12, ApacheLog4j2.15.1-rc1 was officially released, which directly disabled the JNDI function. If the lookup function is required, it is recommended to upgrade to this version and manually set log4j2.formatMsgNoLookups to false as default.<\/p>\n\n\n\n

On December 13, Apache Log4j 2.16.0-rc1 (the same as the stable version 2.16.0) was officially released, which completely removes the vulnerable Message lookups function based on Apache Log4j 2.15.1-rc1.<\/p>\n\n\n\n

On December 14, the Apache Log4j deserialization Code Execution Vulnerability (CEV-2021-4104) is  officially disclosed. When Apache Log4j 1.2.x is in a specific configuration, JMSAppender is vulnerable to deserialization of untrusted data. When attackers have the permission to modify  Log4j configuration, they can execute JNDI requests with JMSAppender by the use of specific configuration, resulting in remote code execution.<\/p>\n\n\n\n

On December 14, Apache Log4j 2.12.2-rc1 was released. JNDI and Lookup functions are disabled by default, and Java 7 is supported.<\/p>\n\n\n\n

On December 15, the official announcement disclosed the DoS vulnerability (CVE-2021-45046) of Apache Log4j. When Log4j is configured to use non-default mode layout and context lookup (such as $${ctx: loginid}) or thread context mapping mode (%Xã€%mdc or %MDC), attackers use JNDI lookup mode to create malicious input data, resulting in a denial of service (DOS). As in Apache Log4j 2.15.0, the vulnerability fix method for CVE-2021-44228 is imperfect, it will be affected by this vulnerability in a specific configuration.<\/p>\n\n\n\n

On December 17, the DoS vulnerability of Apache Log4j was updated to Code Execution Vulnerability (CVE-2021-45046). The fix to CVE-2021-44228 in Apache Log4j 2.15.0 is incomplete in some non-default configurations. When the log configuration uses a non-default mode layout with context lookup (such as$${ctx:loginId}), the attackers who input data by controlling thread context mapping (MDC) can use JNDI search mode to create malicious input data, so as to cause information disclosure, RCE (remote code execution) and LCE (local code execution) attacks, and the CVSS score increased from 3.7 to 9.0. On December 18, Apache Log4j 2.17.0 was officially released and the DoS vulnerability (CVE-2021-45105) in Apache Log4j was disclosed. As Log4j does not prevent uncontrolled recursion in self reference lookup, when the log configuration uses a non-default mode layout with context lookup (such as, $${ctx:loginId}), the attackers who input data by controlling thread context mapping (MDC) can create malicious input data containing recursive lookup, causing DoS attacks in which StackOverflowError kills the process.<\/p>\n\n\n\n

Apache Log4j2 is an open source Java logging framework and widely used in middleware, development framework and web applications to record log information.<\/p>\n\n\n\n

Screenshot of recurrence of CVE-2021-44228:<\/p>\n\n\n\n

\"Red<\/a><\/figure>\n\n\n\n

Screenshot of recurrence of Log4j 2.15.0-rc1 bypass of CVE-2021-44228:<\/p>\n\n\n\n

\"Red<\/a><\/figure>\n\n\n\n
Vulnerability details<\/strong><\/td>Vulnerability <\/strong>PoC<\/strong><\/td>Vulnerability <\/strong>EXP<\/strong><\/td>Use out of office<\/strong><\/td><\/tr>
Published<\/strong><\/strong><\/td>Published<\/strong><\/strong><\/td>Published<\/strong><\/strong><\/td>exist<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Reference link: <\/p>\n\n\n\n

https:\/\/logging.apache.org\/log4j\/2.x\/security.html <\/a><\/p>\n\n\n\n

https:\/\/www.mail-archive.com\/announce@apache.org\/msg06936.html<\/a><\/p>\n\n\n\n

Scope of impact<\/h2>\n\n\n\n

Affected version<\/strong><\/p>\n\n\n\n

CVE-2021-44228<\/strong>：<\/strong><\/p>\n\n\n\n