CVE-2021-45046 in apache log4j
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Affected software: apache log4j, cvat computer vision annotation tool, intel audio development kit, intel datacenter manager, intel genomics kernel library, intel oneapi, intel secure device onboard, intel sensor solution firmware development kit, intel system debugger, intel system studio
Scores
- CVSS: 9.0 (critical)
- EPSS: 99.98% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2023-05-01, used in ransomware
- Published: 2021-12-14
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): Yes, published
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.