cbcvebase.
CVE-2021-44228
published 2021-12-10

CVE-2021-44228: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and…

PriorityP1100critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2021-12-24
Exploited in the wild
EPSS
100.00%
100.0th percentile
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Affected

431 ranges· showing 25
VendorProductVersion rangeFixed in
alluxioalluxio< 2.7.32.7.3
amazonhotpatch< 1.3.51.3.5
amazonlog4jhotpatch< 1.1-161.1-16
amazonlog4jhotpatch< 1.1-131.1-13
amazon_web_serviceslog4j-cve-2021-44228-hotpatch>= unspecified < 1.1-161.1-16
apacheguacamole
apachehadoop
apachelog4j
apachelog4j
apachelog4j>= 2.0.1 < 2.3.12.3.1
apachelog4j>= 2.0.1 < 2.12.22.12.2
apachelog4j>= 2.13.0 < 2.15.02.15.0
apachelog4j>= 2.13.0 < 2.16.02.16.0
apachelog4j>= 2.4.0 < 2.12.22.12.2
apachelogging
apacheofbiz
apachetika
apachetomcat
apache_software_foundationapache_log4j_1.x>= 1.0.1 < unspecifiedunspecified
apache_software_foundationapache_log4j_1.x>= unspecified < 2.0-alpha12.0-alpha1
applexcode< 13.313.3
applexcode
bentleysynchro>= 6.1 < 6.2.4.26.2.4.2
bentleysynchro_4d< 6.4.3.26.4.3.2
ciscoadvanced_malware_protection_virtual_private_cloud_appliance< 3.5.43.5.4

Detection & IOCsextracted from sources · hover to see the quote

  • Post-exploitation activity following Log4Shell includes use of wget/curl to download payloads, chmod to set executable bit, and execution from /tmp — monitor for this combined tool chain.
  • Post-exploitation XMRig miner binaries were downloaded from GitHub using curl after Log4Shell-style initial access; monitor for curl/wget calls to GitHub delivering ELF binaries.
  • ·CVE-2021-44228 (Log4Shell) affects Log4j 2.x; the related CVE-2021-4104 affects Log4j 1.2 only when JMSAppender is explicitly configured — it is not exploitable in default configurations.

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
ghsa10.0CRITICAL
osv10.0CRITICAL
vulncheck10.0CRITICAL
cisa10.0CRITICAL
vendor_apache10.0CRITICAL
vendor_cisco10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_msrc10.0CRITICAL
vendor_redhat10.0CRITICAL
vendor_ubuntu10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.