A zero-day exploit that affects popular auxiliary program Apache Log4j (CVE-2021-44228) was released on December 9, 2021 and may allow Remote Code Execution (RCE).
This vulnerability is already in use and anyone using Log4j should update to version 2.15.0 as soon as possible. The final version is already on the page download Apache.
If you can't update to the latest version, Cloudflare has made available a WAF tweak that can also protect you. You should use one firewall και να ορίσετε την ιδιότητα συστήματος "log4j2.formatMsgNoLookups" σε "true". ή αφαιρώντας την κλάση JndiLookup από τη διαδρομή της κλάσης.
Those who use Cloudflare WAF can also take advantage of three new rules that have been developed to mitigate any exploitation efforts:
| RuleID | Description | Default Action |
|---|---|---|
| 100514 (legacy WAF) 6b1cc72dff9746469d4695a474430f12 (new WAF) |
Log4j Headers | BLOCK |
| 100515 (legacy WAF) 0c054d4e4dd5455c9ff8f01efe5abb10 (new WAF) |
Log4j Body | BLOCK |
| 100516 (legacy WAF) 5f6744fa026a4638bda5b3d7d5e015dd (new WAF) |
Log4j URL | BLOCK |
The firewall rules are three and inspect HTTP headers, body and URL respectively.
More details about the vulnerability can be found in the official Log4j security page.
Who is affected
Log4j is a powerful Java-based log library developed by the Apache Software Foundation.
In all Log4j versions >= 2.0-beta9 and
