A zero-day exploit that affects the popular Apache Log4j utility (CVE-2021-44228) was released on December 9, 2021 and may allow Remote Code Execution (RCE).
This vulnerability is already in use and anyone using Log4j should update to version 2.15.0 as soon as possible. The final version is already on the page download Apache.
If the latest version is not available, Cloudflare has a WAF tweak that can also protect you. You must use a firewall and set the system property "log4j2.formatMsgNoLookups" to "true". or by removing the JndiLookup class from the class path.
Those who use Cloudflare WAF can also take advantage of three new rules that have been developed to mitigate any exploitation efforts:
| RuleID | Description | Default Action |
|---|---|---|
| 100514 (legacy WAF) 6b1cc72dff9746469d4695a474430f12 (new WAF) |
Log4j Headers | BLOCK |
| 100515 (legacy WAF) 0c054d4e4dd5455c9ff8f01efe5abb10 (new WAF) |
Log4j Body | BLOCK |
| 100516 (legacy WAF) 5f6744fa026a4638bda5b3d7d5e015dd (new WAF) |
Log4j URL | BLOCK |
The firewall rules are three and inspect HTTP headers, body and URL respectively.
More details about the vulnerability can be found in the official Log4j security page.
Who is affected
Log4j is a powerful Java-based log library developed by the Apache Software Foundation.
In all versions Log4j> = 2.0-beta9 and <= 2.14.1, the JNDI capabilities used in the configuration, log messages, and parameters can be exploited by an attacker to execute remote code execution. In particular, an attacker who can control logs or log message parameters can run arbitrary code loaded from LDAP servers when message retrieval is enabled.
