Critical Remote Code Execution Vulnerability in Apache Log4j 2.x
Summary
CVE-2017-5645: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c... Affects apache-log4j2 across 3 version ranges.
< 2.7-2
>= 8d9204a4b4c6016fa6b36513a46502689d6a45c1, < 097426a2154a6079cddd897502b6fb3ce5d50338
>= dc2767d740168485ceb9db7c8ed4004cd5d79032, < 054635595a6dae38c56a2592d9ecc5987e841afd
Fixed in 2.7-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Log4j is a widely used Java-based logging utility that enables developers to log application behavior and performance. It is integral to many Java applications, providing features such as logging levels, formatting, and output destinations. However, versions prior to 2.8.2 are susceptible to a serious vulnerability that allows remote code execution through deserialization of malicious payloads sent over TCP or UDP sockets.
Vulnerability Detail
In Apache Log4j 2.x versions before 2.8.2, a vulnerability exists when using the TCP or UDP socket server to receive serialized log events. An attacker can send a specially crafted binary payload that, upon deserialization, can execute arbitrary code on the server. This vulnerability poses a significant risk as it allows unauthorized access and control over the affected system, potentially leading to data breaches or system compromise.
How To Fix
Minimum fixed version
2.7-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache-log4j2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider disabling the TCP and UDP socket servers in your Log4j configuration to prevent the exploitation of this vulnerability. This can be done by modifying the logging configuration file to remove or comment out the socket server settings.
Conclusion
The vulnerability in Apache Log4j 2.x prior to version 2.8.2 poses a significant risk due to its potential for remote code execution. It is crucial for users of this library to upgrade to the latest version or implement workarounds to mitigate the risk. Regular monitoring and vulnerability management practices, such as those offered by Vulert, can help maintain the security of your applications.
See every vulnerability recorded for apache-log4j2 →
FAQ
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized remote code execution, allowing attackers to gain control over the affected system and potentially access sensitive data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If immediate upgrading is not possible, disable the TCP and UDP socket servers in your Log4j configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for apache-log4j2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
