The security flaw in the Apache Log4j library turned out to be exceptionally dangerous for many companies and businesses. What steps should you take to avoid the risk this vulnerability poses?
- What is Apache Log4j
Apache Log4j is a Java library whose main purpose is to generate logs while an application is running. This cross-platform library was created to make it easier to check the values of variables and the current state of an application. It’s worth adding that it’s one of the libraries used commercially by a large number of applications.
- The Log4j vulnerability and its consequences
The critical vulnerability found in the Log4j library allows remote code execution with the privileges of the affected application. This gives an attacker the ability to download a payload from a remote server and execute it locally. Exploiting this weakness is very easy for hackers and lets them scan available services to attempt exploitation. One attack exploiting the Log4j vulnerability might look like this:
- The application logs events such as failed user logins, recording values like the username or email
- The hacker logs in, supplying a malicious payload (a piece of transmitted data) as the username, using a server controlled by the attacker
- A flaw in Log4j is triggered by the payload, causing the server to send a request via JNDI (Java Naming and Directory Interface)
- In response, the attacker obtains a path to a remote Java class file, which is applied to the server’s processor
- The applied payload allows the hackers to execute arbitrary code
The consequence of such an attack is that the attacker gains the ability to execute arbitrary commands on the server.
- Who is at risk?
The attack vector isn’t limited to web applications, meaning that, as a result, all applications written in Java that use the Apache Log4j library are at risk. In addition, this vulnerability occurs regardless of the version of the Java Development Kit being used. That said, a successful attack requires the attacker to send the appropriate communication over HTTP/HTTPS or another protocol.
- Recommendations
Once the vulnerability was discovered, the most recommended version of the Log4j library became 2.16.0. The priority is to check and patch systems accessible from the internet, as well as resources critical to the operation of the company or organization. Another important step is software updates. However, these are tasks that specialists should handle.
To avoid the risk, it’s worth using services that detect the Log4j vulnerability, such as the ReconMore software. An infrastructure analysis via ReconMore will check whether Log4j is present and detect any weaknesses. This kind of scan helps prevent unwanted threats related to the Log4j vulnerability.
The first attacks targeting vulnerable servers are already behind us. The Log4j vulnerability is exceptionally malicious and easy to exploit. All of this means the flaw needs to be addressed immediately, in order to reconfigure the logger and prevent further exploitation in an attack.