Log4Shell exploitation: Which applications may be targeted next?
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×9 |
| masshundreds of millions of Java applications/devices, with hundreds of thousands of internet-exposed services | |
| CVE-2022-22965 | Unauthenticated RCE in VMware Spring Framework (Spring4Shell) - JDK 9+ Tomcat WARs CVE-2022-22965 ('Spring4Shell') is a critical (CVSS 9.8) remote code execution flaw in VMware's Spring Framework, caused by insecure data binding that lets unauthenticated attackers overwrite internal class and module properties through crafted request parameters (CWE-94, code injection). It affects Spring MVC and Spring WebFlux applications running on JDK 9 or later; the demonstrated exploit path requires a Tomcat WAR deployment, while applications packaged as Spring Boot executable jars are not exploitable that way, though the underlying issue may be reachable via other routes. A successful attack yields full remote code execution with the privileges of the application server, with no authentication or user interaction required. VMware Spring Framework 5.3.0-5.3.17 and 5.2.0-5.2.19 (plus older releases) are affected, and the flaw also impacts bundled products from Cisco, Oracle, Siemens and Veritas, including multiple Oracle Communications Cloud Native Core components. It is being actively exploited in the wild: added to CISA's KEV on 2022-04-04, EPSS puts 30-day exploitation probability at 99.6% (100th percentile), a public PoC is available, and mass scanning of vulnerable servers has been observed. Do: Upgrade Spring Framework to 5.3.18, 5.2.20 or later (or apply vendor-supplied fixes for bundled products, e.g., via Oracle's patch release and Cisco's advisory), prioritizing internet-facing Tomcat WAR deployments on JDK 9+; this is a CISA KEV entry, so treat patching as urgent. If patching must wait, mitigate by running on JDK 8, deploying as a Spring Boot executable jar rather than a WAR on Tomcat, and applying the vendor-documented workaround that disallows 'class.*', 'Class.*' and 'module.*' fields in data binding. Inventory exposed Tomcat/Spring services and hunt for signs of exploitation given confirmed in-the-wild use. | 9.8 | 100% | KEV PoC |
| massmass - on the order of 1M+ Spring-based Java deployments overall, with at least ~100,000 internet-exposed Tomcat servers on JDK 9+ plausibly meeting the… |
Full article657 words · extracted from helpnetsecurity.com · click to collapse
Spring4Shell (CVE-2022-22965) has dominated the information security news these last six days, but Log4Shell (CVE-2021-44228) continues to demand attention and action from enterprise defenders as diverse vulnerable applications are being targeted in attacks in the wild.
Attackers in the wild exploiting Log4Shell
Log4Shell is widespread because Apache Log4j – the logging library that it affects – is widely used. While its exploitability depends on the Java version, the Log4j version (only Log4j v2 is vulnerable) and how it’s used, the vulnerability is easily triggered with the right exploit.
Since the revelation of its existence, many threat actors have been targeting it to compromise VMware Horizon servers, Ubiquity Unifi applications, MobileIron mobile device management systems, IoT devices, and other products.
VMware Horizon servers are a particularly popular target and are being mostly compromised to deploy cryptocurrency mining malware, Sophos researchers Gabor Szappanos and Sean Gallagher noted. But some attackers are popping them and deploying backdoors, reverse shells and remote monitoring tools, possibly preparing them for future attacks involving ransomware or corporate espionage.
Fortiguard Labs researchers Rotem Sde-Or and Eliran Voronovitch also recently flagged a a campaign by a threat actor they believe to be Deep Panda, a Chinese APT group, exploiting Log4Shell in VMware Horizon servers to deploy a backdoor and a novel kernel rootkit (“Fire Chili”) onto target machines.
Mandiant researchers, on the other hand, have documented several threat actors attempting to exploit MobileIron MDM systems. Some, they believe, have financial motivations, while others are engaged in espionage. They have also been unable to discern the motivation of one particular threat actor.
Which other widespread applications can make good targets?
Log4Shell affects a wide variety of software products and many organizations will have trouble assessing their exposure and choosing which patches should be proritized.
Randori’s team of researchers have assessed that VMware Horizon and MobileIron are, indeed, among the top 3 most “attackable” applications using Log4j out there, despite the latter not being among the top 10 most widespread apps using the logging library and being exposed on the internet.
“Attackers cannot afford to be caught or sent on wild goose chases. As such, the most attackable assets are determined based on where the most initial damage (access) would likely occur,” they explained their reasoning.
Solutions that allow attackers privileged access, that don’t have security software on them, and that provide hackers “downstream” access are likely to be the most attractive targets, and this is why Randori’s lists of most widespread and most attackable applications do not match.
“Most of the widespread software are app servers or middleware – cPanel, [Apache] Tomcat, [Eclipse] Jetty, [Eclipse] JSP, Wildfly – which are not 100% confirmed to use a vulnerable version of Log4j, making them a less interesting target to an attacker. These types of services may use optional components that use Log4j, and might come in a variety of configurations which can complicate locating an exploitable mechanism, so an attacker may not want to waste his time (especially if there is an easier target),” the researchers noted.
VMware Horizon extremely common (10% of large enterprises have an internet-exposed instance) and if hacked, it gives a hacker downstream access.
Jamf is a configuration automation platform that is known to be vulnerable and exploitable, and a compromised instance would allow attackers to influence any device that is being administered by it, the researchers explained. MobileIron – an MDM solution – offers similar access.
Ping Identity’s PingFederate – an authentication and SSO platform – may be similarly helpful. “If an adversary can control the AUTH server and process, they can likely impact many other services that are serviced by that authentication mechanism. This becomes even more interesting if the way it’s configured enables the attacker to create users in your environment,” they pointed out.
The list continues with Jenkins (automation server vulnerable through plugins that use Log4j), Avaya IP Office (management system is vulnerable) and SAP’s NetWeaver (a Java application server).
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/04/05/log4shell-applications-targeted/