CVE-2022-23302: Log4j 1.x Deserialization of Untrusted Data
Summary
CVE-2022-23302: Deserialization of Untrusted Data in Log4j 1.x. Affects log4j:log4j versions < 1.2.17. No fix is published. How to fix ↓
Also tracked for
- apache-log4j1.2 · Debian:11
The same CVE-2022-23302 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Log4j is a popular logging library used in Java applications. It provides a flexible and configurable framework for logging messages at various levels of severity. Log4j 1.x is an older version of the library that reached end of life in August 2015. It is still used in some legacy applications. Log4j 1.x includes a component called JMSSink, which allows logging events to be sent to a Java Message Service (JMS) provider. This vulnerability affects Log4j 1.x when specifically configured to use JMSSink.
Vulnerability Detail
The vulnerability in Log4j 1.x arises from the deserialization of untrusted data. If an attacker has write access to the Log4j configuration or if the configuration references an LDAP service that the attacker has access to, they can provide a malicious configuration that triggers the vulnerability. By providing a TopicConnectionFactoryBindingName configuration, the attacker can cause JMSSink to perform JNDI requests that result in remote code execution. This can lead to a complete compromise of the affected system. It is important to note that this vulnerability only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default configuration.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to Log4j 2 is not immediately feasible, a possible workaround is to disable the use of JMSSink in the Log4j 1.x configuration. This can be done by removing or commenting out any references to JMSSink in the configuration file. However, this workaround should be considered temporary, and upgrading to Log4j 2 is still strongly recommended.
Conclusion
The Log4j 1.x vulnerability (CVE-2022-23302) exposes systems to the risk of remote code execution. It is crucial to upgrade to Log4j 2, which addresses this vulnerability and provides enhanced security features. Additionally, securing the Log4j configuration and restricting access to LDAP services can help mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for log4j:log4j →
FAQ
Log4j is a logging library used in Java applications to record log messages at various levels of severity.
Log4j 1.x is an older version of the Log4j library that reached end of life in August 2015. It is still used in some legacy applications.
JMSSink is a component in Log4j 1.x that allows logging events to be sent to a Java Message Service (JMS) provider.
The vulnerability occurs due to the deserialization of untrusted data in Log4j 1.x when specifically configured to use JMSSink. An attacker with write access to the Log4j configuration or access to an LDAP service referenced in the configuration can exploit this vulnerability.
The vulnerability can lead to remote code execution, allowing an attacker to take control of the affected system. This can result in unauthorized access, data breaches, and other malicious activities.
Related vulnerabilities
Recent vulnerabilities recorded for log4j:log4j.
