Apache Log4j2 Remote Code Execution via JNDI Injection
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Techniques marked “observed” are corroborated by threat intelligence; the rest are inferred from the weakness type (CWE) and attack vector.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Groups documented using the techniques observed against this CVE — a tradecraft association, not a confirmed attribution. Overlap count shown; click for the MITRE profile.
These techniques were analysed against this CVE's real-world exploitation — the matching entries in the ATT&CK chain above are marked “observed”.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
For Log4j2 versions 2.10.0 and higher but below 2.15.0, set the system property log4j2.formatMsgNoLookups to true or remove the JndiLookup class from the classpath. Implement strict network segmentation and egress filtering to restrict outbound LDAP/RMI connections from vulnerable systems. Enhance monitoring to detect unusual outbound connections or process execution attempts originating from Log4j-dependent applications.
The permanent resolution is to upgrade Apache Log4j2 to version 2.17.1 or newer, as this fully removes the vulnerable JNDI lookup functionality. Alternatively, upgrade to version 2.12.3 for Java 7 users, or version 2.3.2 for Java 6 users. Ensure all instances of the log4j-core library across all applications are identified and updated to a secure version immediately.
An attacker who can control log messages or parameters can achieve remote code execution (RCE) on the affected system. This allows for full system compromise, including data theft, service disruption, and the establishment of persistent backdoors. Given the widespread use of Log4j2, this vulnerability has significant technical and business implications across various applications.
Other CVEs affecting log4j
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Buffer overflow in the HTML parser for Netscape 4.75 and earlier allows remote attackers to execute arbitrary commands via a long password value in a form field.
Buffer overflow in Netscape Navigator/Communicator 4.7 for Windows 95 and Windows 98 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long argument after the ? character in a URL that references an .asp, .cgi, .html, or .pl file.