Log4Shell was in the wild at least nine days before public disclosure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-22448 | There is an improper verification vulnerability in smartphones. There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause unauthorized read and write of some files. NVD description · AI analysis pending | 9.1 | <1% |
| — | ||
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×9 |
| masshundreds of millions of Java applications/devices, with hundreds of thousands of internet-exposed services |
Full article474 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 13, 2021
Threat actors are already abusing Log4Shell vulnerability in the Log4j library for malicious purposes such as deploying malware.
A few hours ago, researchers at NetLab 360 reported that their Anglerfish and Apacket honeypots were already hit by attacks attempting to trigger the Log4Shell flaw in the Log4j library. The attempts were carried out by Muhstik and Mirai botnets in attacks aimed at Linux devices.
Other research teams observed threat actors attempting to exploit the vulnerability, the Microsoft Threat Intelligence Center confirmed that attackers are using it to drop Cobalt Strike beacons and coin miners.
“At the time of publication, the vast majority of observed activity has been scanning, but exploitation and post-exploitation activities have also been observed. Based on the nature of the vulnerability, once the attacker has full access and control of an application, they can perform a myriad of objectives. Microsoft has observed activities including installing coin miners, Cobalt Strike to enable credential theft and lateral movement, and exfiltrating data from compromised systems.” reads the analysis published by Microsoft.
The situation is worse than initially thought because the vulnerability has been under attack for at least more than a week prior to its public disclosure on December 10. Below is the tweet published by Cloudflare CEO Matthew Prince.
Earliest evidence we’ve found so far of #Log4J exploit is 2021-12-01 04:36:50 UTC. That suggests it was in the wild at least 9 days before publicly disclosed. However, don’t see evidence of mass exploitation until after public disclosure.
— Matthew Prince 🌥 (@eastdakota) December 11, 2021
Cisco Talos researchers first spotted activities related to the log4Shell vulnerability on December 2.
“Cisco Talos has observed attacker activity related to CVE-2021-22448 beginning 02-December-2021. It is recommended that organizations expand their hunt for scanning and exploit activity to this date.” reads the advisory published by Cisco Talos. “Attackers may also leverage this vulnerability as a means of information disclosure to exfiltrate credentials (and other configurations) stored in files and environment variables from a vulnerable host. For example, the AWS CLI uses environment variables and configuration files that can be exfiltrated by exploiting CVE-2021-22448. Please see the Information Leaks section for more information.”
Talos researchers also updated the list of IOCs to include information about mining activity carried out by exploiting the CVE-2021-44228 flaw. The researchers spotted mining activity aimed at delivering of the Kinsing crypto-miner.
Auvik, Huntress Lab, and N-able also confirmed their services have been impacted before Decembre10. Huntress lab researchers have created a tool to help organizations to test whether their applications are vulnerable to CVE-2021-44228.
If you are interested in more details about the issue, let me suggest reading this analysis from the Swiss CERT.
https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Log4Shell)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/125567/hacking/log4shell-log4j-exploitation.html