2021Vulnerability exploitation
Log4Shell (Apache Log4j vulnerability)
Disclosed 9 to 10 December 2021
Log4Shell (CVE-2021-44228) was a remote code execution flaw in Apache Log4j 2, a logging library embedded in countless Java applications. Attackers could trigger it simply by getting a crafted string logged. The US Cyber Safety Review Board later called it an endemic vulnerability that would remain in systems for years.
- Victim
- Organisations running software that included Apache Log4j 2
- Sector
- Cross-sector
- Public attribution
- A vulnerability exploited by many unrelated actors; no single attribution applies.
Impact
Mass scanning and exploitation began within days of disclosure, and organisations spent weeks finding where the library was used (CSRB).
Root cause
A dangerous feature (JNDI lookups in log messages) in a ubiquitous open-source component, which many organisations could not locate because they lacked software inventories.
Lessons learned: the controls it teaches
- Keep a software bill of materials so you can find vulnerable components quickly.
- Support the open-source projects your business depends on.
- Restrict outbound connections from servers, which blocked many exploitation attempts.