Remote Code Injection in Log4j (com.splunk.logging:splunk-library-javalogging)
Summary
GHSA-94g7-hpv8-h9qm: Remote code injection in Log4j. Affects com.splunk.logging:splunk-library-javalogging across 2 version ranges.
< 1.6.2-0-0
>= 1.7.0, < 1.11.1
Fixed in 1.6.2-0-0 or 1.11.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.splunk.logging:splunk-library-javalogging package is a Java logging library provided by Splunk. It is used for logging purposes in Java applications, allowing developers to capture and store log messages for analysis and troubleshooting. This package integrates with Log4j, a popular logging framework in the Java ecosystem.
Vulnerability Detail
The vulnerability identified in the com.splunk.logging:splunk-library-javalogging package is a remote code injection flaw in Log4j. When using a vulnerable version of Log4j and logging untrusted or user-controlled data, an attacker can exploit this vulnerability to execute arbitrary code remotely. This can occur when logging various types of data, including exception traces, authentication failures, or any unexpected user-controlled input. The impact of this vulnerability is critical, as it can lead to remote code execution in the affected application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.6.2-0-01.6.2-0-0 -
>= 1.7.0, < 1.11.11.11.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately possible, a workaround can be implemented by setting the system property -Dlog4j2.formatMsgNoLookups=true on both the client-side and server-side components. This workaround disables the Log4j lookups, which can help mitigate the risk of remote code injection. However, it is strongly advised to upgrade to a patched version as soon as possible for a more comprehensive and secure solution.
Conclusion
The remote code injection vulnerability in Log4j poses a critical risk to applications using the com.splunk.logging:splunk-library-javalogging package. It is crucial to upgrade to a non-vulnerable version (1.11.1) or apply the backport patch (1.6.2-0-0) to mitigate this vulnerability. If immediate upgrading is not possible, implementing the workaround by setting the system property -Dlog4j2.formatMsgNoLookups=true can provide temporary mitigation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.splunk.logging:splunk-library-javalogging →
FAQ
The impact of this vulnerability is critical, as it allows an attacker to remotely execute arbitrary code in the affected application. This can lead to complete compromise of the system, unauthorized access, and potential data breaches.
To fix this vulnerability, it is recommended to upgrade to version 1.11.1 of the Splunk Logging for Java library. Alternatively, you can apply the backport patch for version 1.6.2. It is crucial to update the library to a non-vulnerable version to ensure the security of the application.
Yes, if upgrading to a patched version is not immediately possible, you can implement a workaround by setting the system property -Dlog4j2.formatMsgNoLookups=true on both the client-side and server-side components. This workaround disables the Log4j lookups and helps mitigate the risk of remote code injection.
Yes, there are known exploits for this vulnerability. Attackers can craft malicious log messages containing code that will be executed when logged by the vulnerable Log4j library. It is crucial to address this vulnerability promptly to prevent exploitation.
You can find more information about this vulnerability in the advisory published on GitHub: https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
