Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021
AI summary · glm-5.3-flashSummaries by Vani AI
Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.
Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.
Key facts
- CVE-2021-44228 allows trivial RCE via crafted JNDI lookup strings in logged input
- Public PoC code is available and mass scanning of internet-facing systems is underway
- Observed post-exploitation includes Cobalt Strike delivery, coinmining, and data theft
- Upgrade to Log4j 2.17.1 fixes CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832
- Affected software includes Struts, Solr, Druid, Flink, ElasticSearch, Logstash, Kafka
- Malware
- Cobalt Strike
- Organizations
- Palo Alto Networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-5645 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially… | 9.8 | 90% | ||
| CVE-2019-17571 | Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code… | 9.8 | 69% | ||
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) | 10.0 | 100% | KEVRansomwarePoC ×9 | KEV |
| CVE-2021-44832 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when… | 6.6 | 98% | ||
| CVE-2021-45046 | Remote Code Execution in Apache Log4j2 via Incomplete Log4Shell Fix | 9.0 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-45105 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups | 5.9 | 100% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 1ma.xyz | mpts that involved a callback URL that contained the domain 1ma[.]xyz , as seen in the following example: <redacted>.com.80.ref |
| domain | automationyesterday.com | 346,888 195.54.160[.]149 250,042 canarytokens[.]com 198,954 automationyesterday[.]com 166,206 45.83.193[.]150 120,707 64.39.98[.]200 118,860 pr |
| domain | burpcollaborator.net | .]159 80,075 interactsh[.]com 68,959 5.101.118[.]127 51,515 burpcollaborator[.]net 51,066 31.131.16[.]127 48,119 45.66.8[.]12 46,753 185.246 |
| domain | canarytokens.com | [.]in 552,521 45.83.64[.]1 346,888 195.54.160[.]149 250,042 canarytokens[.]com 198,954 automationyesterday[.]com 166,206 45.83.193[.]150 |
| domain | interact.sh | 36,563,784 nessus[.]org 14,638,414 172.16.0.0/12 1,818,036 interact[.]sh 852,778 oob[.]li 571,042 sploit[.]in 552,521 45.83.64[.]1 |
| domain | interactsh.com | rt[.]tech 83,875 upguard[.]com 83,379 193.3.19[.]159 80,075 interactsh[.]com 68,959 5.101.118[.]127 51,515 burpcollaborator[.]net 51,0 |
| domain | nessus.org | ity scanning services are represented in this list, such as nessus[.]org as the top callback involving a remote location. Domain/I |
| domain | oob.li | rg 14,638,414 172.16.0.0/12 1,818,036 interact[.]sh 852,778 oob[.]li 571,042 sploit[.]in 552,521 45.83.64[.]1 346,888 195.54.1 |
| domain | praetorian.com | ]com 166,206 45.83.193[.]150 120,707 64.39.98[.]200 118,860 praetorian[.]com 115,739 192.168.0.0/16 86,513 securitysupport[.]tech 83,8 |
| domain | securitysupport.tech | ]200 118,860 praetorian[.]com 115,739 192.168.0.0/16 86,513 securitysupport[.]tech 83,875 upguard[.]com 83,379 193.3.19[.]159 80,075 interac |
| domain | sploit.in | .16.0.0/12 1,818,036 interact[.]sh 852,778 oob[.]li 571,042 sploit[.]in 552,521 45.83.64[.]1 346,888 195.54.160[.]149 250,042 can |
| domain | upguard.com | 115,739 192.168.0.0/16 86,513 securitysupport[.]tech 83,875 upguard[.]com 83,379 193.3.19[.]159 80,075 interactsh[.]com 68,959 5.10 |
| ipv4 | 139.155.2.105 | t attempts that included the following callback URL: ldap://139.155.2[.]105:8888/EvilObj The above URL will result in the following f |
| ipv4 | 150.60.139.51 | xecute them. The first file downloaded was hosted at hxxp://150.60.139[.]51:80/wp-content/themes/twentyseventeen/s.cmd , which contai |
| ipv4 | 161.35.184.54 | , the server would download a Java class file from a hxxp://161.35.184[.]54:9998/V8.class URL, which responds with a Java class file |
| ipv4 | 165.22.2.186 | ovides the Java class that installs a coinminer. The hxxp://165.22.2[.]186:80/wp-content/themes/twentyseventeen/Exploit.class respon |
| ipv4 | 185.246.87.50 | tor[.]net 51,066 31.131.16[.]127 48,119 45.66.8[.]12 46,753 185.246.87[.]50 44,516 Table 2. Top domains and IP addresses seen in call |
| ipv4 | 192.46.216.224 | exploit attempt included the following callback URL: ldap://192.46.216[.]224:1389/Exploit The callback URL responds with the following |
| ipv4 | 193.3.19.159 | 6 86,513 securitysupport[.]tech 83,875 upguard[.]com 83,379 193.3.19[.]159 80,075 interactsh[.]com 68,959 5.101.118[.]127 51,515 bur |
| ipv4 | 195.54.160.149 | 8 oob[.]li 571,042 sploit[.]in 552,521 45.83.64[.]1 346,888 195.54.160[.]149 250,042 canarytokens[.]com 198,954 automationyesterday[.] |
| ipv4 | 2.57.121.36 | in exploit attempts over the course of several days: ldap://2.57.121[.]36:8000/mss_useragent ldap://2.57.121[.]36:8000/mss_xapi lda |
| ipv4 | 31.131.16.127 | 68,959 5.101.118[.]127 51,515 burpcollaborator[.]net 51,066 31.131.16[.]127 48,119 45.66.8[.]12 46,753 185.246.87[.]50 44,516 Table 2 |
| ipv4 | 45.66.8.12 | 51,515 burpcollaborator[.]net 51,066 31.131.16[.]127 48,119 45.66.8[.]12 46,753 185.246.87[.]50 44,516 Table 2. Top domains and IP |
| ipv4 | 45.83.193.150 | anarytokens[.]com 198,954 automationyesterday[.]com 166,206 45.83.193[.]150 120,707 64.39.98[.]200 118,860 praetorian[.]com 115,739 1 |
| ipv4 | 45.83.64.1 | interact[.]sh 852,778 oob[.]li 571,042 sploit[.]in 552,521 45.83.64[.]1 346,888 195.54.160[.]149 250,042 canarytokens[.]com 198,9 |
| ipv4 | 5.101.118.127 | [.]com 83,379 193.3.19[.]159 80,075 interactsh[.]com 68,959 5.101.118[.]127 51,515 burpcollaborator[.]net 51,066 31.131.16[.]127 48,1 |
| ipv4 | 64.39.98.200 | 4 automationyesterday[.]com 166,206 45.83.193[.]150 120,707 64.39.98[.]200 118,860 praetorian[.]com 115,739 192.168.0.0/16 86,513 se |
| ipv4 | 68.183.165.105 | attempts to download and execute an application from hxxp://68.183.165[.]105:80/wp-content/themes/twentyseventeen/xmrig64.exe , which |
| url | http://139.155.2.105:8081 | ava class file from a remote server. The EvilObj.class from hxxp://139.155.2[.]105:8081 contains the decompiled Java code as seen in Figure 13. F |
| url | http://150.60.139.51:80/wp-content/themes/twentyseventeen/s.cmd | s and execute them. The first file downloaded was hosted at hxxp://150.60.139[.]51:80/wp-content/themes/twentyseventeen/s.cmd , which contains the following PowerShell that would be r |
| url | http://161.35.184.54:9998/V8.class | e above, the server would download a Java class file from a hxxp://161.35.184[.]54:9998/V8.class URL, which responds with a Java class file whose decompil |
| url | http://165.22.2.186:80/wp-content/themes/twentyseventeen/Exploit.class | that provides the Java class that installs a coinminer. The hxxp://165.22.2[.]186:80/wp-content/themes/twentyseventeen/Exploit.class responded with a Java class that contained the decompiled |
| url | http://2.57.121.36/juccess | e, this does nothing more than issue an HTTP GET request to hxxp://2.57.121[.]36/juccess and does nothing with the response. This Java code sugges |
| url | http://2.57.121.36/Rjava.class | cessing this URL, the server would access a Java class from hxxp://2.57.121[.]36/Rjava.class , which contained the decompiled code seen in Figure 8. F |
| url | http://68.183.165.105:80/wp-content/themes/twentyseventeen/xmrig64.exe | ommand attempts to download and execute an application from hxxp://68.183.165[.]105:80/wp-content/themes/twentyseventeen/xmrig64.exe , which is the XMRig executable used to mine the Monero c |
| url | http://[hostname | The HTTP POST requests would be sent to the following URLs: hxxp://[hostname].[username]8.pef.mur.1ma[.]xyz/ hxxp://[hostname].[username |
| url | https://[hostname | [.]xyz/ hxxp://[hostname].[username]5.pef.mur.1ma[.]xyz:53/ hxxps://[hostname].[username]4.pef.mur.1ma[.]xyz/ The DNS tunneling involves |
From the original article
13 min read at unit42.paloaltonetworks.com
On Dec. 9, 2021, a remote code execution (RCE) vulnerability in Apache Log4j 2 was identified being exploited in the wild. Public proof of concept (PoC) code was released and subsequent investigation revealed that exploitation was incredibly easy to perform.
unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.