Remote Code Injection Vulnerability in Log4j Library
Summary
GHSA-3qpm-h9ch-px3c: Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library. Affects org.powernukkit:powernukkit versions < 1.5.2.1. Fixed in 1.5.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Log4j library is a popular logging utility used by PowerNukkit, an open-source project. It provides a flexible and efficient logging framework for Java applications. However, the Log4j library is vulnerable to a remote code injection vulnerability (CVE-2021-44228 and CVE-2021-45105) due to improper input validation and uncontrolled recursion in the ldap JNDI parser.
Vulnerability Detail
The remote code injection vulnerability in Log4j allows malicious clients to send crafted messages that can trigger remote code execution on the server. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. The vulnerability is rated as critical with a CVSS score of 10.0, indicating its severity and potential impact.
How To Fix
Minimum fixed version
1.5.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to use the -Dlog4j2.formatMsgNoLookups=true startup argument. This argument prevents the vulnerability from being exploited by disabling lookups in log messages. However, this is not a permanent solution, and upgrading to the latest patched version is strongly recommended.
Conclusion
The Log4j library used by PowerNukkit is vulnerable to a critical remote code injection vulnerability. To mitigate the risk, it is essential to update PowerNukkit to version 1.5.2.1 or apply the temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.powernukkit:powernukkit →
FAQ
Log4j is a logging utility for Java applications that provides a flexible and efficient logging framework.
The vulnerability allows remote code execution, which can lead to unauthorized access, data breaches, and potential compromise of the entire system.
To fix the vulnerability, update PowerNukkit to version 1.5.2.1, which includes the patched version of Log4j (2.17.0).
Yes, all versions prior to 1.5.2.1 are affected by the vulnerability. It is crucial to upgrade to the patched version.
Yes, you can use the -Dlog4j2.formatMsgNoLookups=true startup argument as a temporary workaround to disable lookups in log messages.
