Remote Code Execution in Apache Log4j2 via Incomplete Log4Shell Fix
CISA: Apache Log4j2 Deserialization of Untrusted Data Vulnerability
CVSS 3.1
9.0critical
EPSS
100%p100
Published
()
KEV added
AI analysis
CVE-2021-45046 is a remote code execution and information disclosure flaw in Apache Log4j2 (CWE-917) that resulted from an incomplete fix to CVE-2021-44228 (Log4Shell), leaving the Thread Context Lookup Pattern vulnerable in certain non-default configurations. It is triggered when an application logs attacker-controlled data using layouts or patterns that perform Thread Context (MDC) lookups, allowing crafted lookup expressions to be evaluated against untrusted input. A successful attacker can achieve remote code execution, or potentially information disclosure, on the affected service. Any deployment of Apache Log4j2 that relies on the affected non-default lookup configurations is exposed, which given Log4j2's ubiquity in Java applications and embedded products means a very large installed base. Exploitation is confirmed: the flaw is in CISA KEV (added 2023-05-01) with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days.
What to do: Upgrade Log4j2 to 2.17.0 or later per vendor instructions (or 2.12.3/2.3.1 for the legacy 2.12/2.3 branches), since the 2.16.0 fix was itself incomplete in some non-default configurations. Where upgrading is not immediately possible, remove the JndiLookup class from the Log4j2 jar or disable lookup processing, and audit applications and dependencies that bundle Log4j2 while following the CISA KEV required action to apply vendor updates.
Affected
Apache Log4j2
Log4j 2.x; per Apache advisory, 2.0-beta9 through 2.15.0 (and 2.16.0 in some non-default configurations), fixed in 2.17.0 and in 2.12.3/2.3.1 for older branches
Estimated exposure
massmillions of Java deployments worldwide, with hundreds of thousands of internet-exposed services observed in public scans during the Log4Shell campaign — Log4j2 is one of the most widely deployed Java logging libraries, bundled by default in countless applications and products, and internet-wide scans following Log4Shell (CVE-2021-44228) identified hundreds of thousands of exposed systems…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.