Apache releases updates for the second vulnerability in Log4j that could lead to DoS while a third vulnerability rises, which leads to sensitive data exfiltration under certain circumstances...
Continue reading
Web infrastructure and security company Cloudflare disclosed a second bug of Log4j that threat actors actively exploit. Tracked as CVE-2021-45046 has a CVSS rating of 3.7 affects versions from 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0. The vulnerability lies within the Log4j2 Thread Context Message Pattern and Context Lookup Pattern, which would allow a threat actor to launch a denial of service attack.
The update released for the CVE-2021-22448 does not provide mitigation against CVE-2021-45046; hence, anyone that uses Log4j must immediately update to the patched version of 2.16.0.
*"This is due to a specific behavior in Log4j 2 that allows for the input of variable data into the log. In a Lookup, the reference is queried and evaluated for input into the log. Using this feature during an exploit, the attacker uses the URI input to instruct Log4j 2 to resolve an object they input," said Google in their blog post*.
Apache has already released a patch for this vulnerability; according to the CVE description, Log4j version 2.16.0 remediates the bug by completely removing support for message lookup patterns and disabling JNDI functionality by default.
Redhat found a flaw in older versions of log4j 1.x that is vulnerable to deserialization of trusted data. The vulnerability that is rated 8.1 CVSS(high) only affects applications that are configured to use JMSAppender.
It can result in remote code execution when the configuration is set to `TopicBindingName` or `TopicConnectionFactoryBindingName`. The issue can be mitigated by removing JMSAppender in the configuration or by removing the JMSAppender class from the classpath.
`zip -q -d log4j-*.jar org/apache/log4j/net/JMSAppender.class`
Researchers of Praetorian discovered that version 2.15.0 could allow the exfiltration of sensitive data under certain circumstances. Technical details about the exploit have been withheld to avoid further attacks. Nonetheless, Apache has received information about the issue, and experts warn all customers to update to version 2.16.0 as soon as possible.
The following video released by Praetorian demonstrates the exfiltration of data in Log4j version 2.15.0.
On December 10, 2021, experts from Advintel noticed a sophisticated ransomware group Conti leveraging Log4j2 vulnerabilities. Conti operators targeted specific Log4j2 vulnerability in VMware vCentre. Networks from US and European areas were compromised since they could move laterally using the pre-existing Cobalt Strike sessions.
*“It is only a matter of time until Conti and possibly other groups will begin exploiting Log4j2 to its full capacity. It is recommended to patch the vulnerable system immediately and view the Log4j2 as a ransomware group exploitation vector.”*
-While CVE-2021-44228 was addressed in log4j 2.15.0, it is vulnerable to denial of service attacks through JNDI. This can be fixed by upgrading to 2.16.0, where JNDI is disabled by default. -Version 2.16.0 also has disabled message lookup functions for a more robust vulnerability fix.
Backdoor.Daxin, the kernel-mode rootkit Symantec once called the most advanced tool ever tied to a China-linked espionage actor, has been found running again
