Skip to main content

5 posts tagged with "data-breaches"

View All Tags

· 9 min read
Chris Thompson

TL;DR - The latest vulnerabilities found in Log4j 2.17.0 are much less serious than the hype would suggest. Continue to patch your systems to at least Log4j 2.17.0 (Java 8) or 2.12.3 (Java 7).

All aboard the Log4Shell hype train Anyone on this train deserves a much-needed break.

After a DOS attack with limited impact was discovered in 2.16.0 and log4j was updated to 2.17.0 to fix it, another even less impactful vulnerability was discovered in 2.17.0. I wonder if we should say "vulnerability" in quotes because this latest vulnerability requires an attacker to have access to the logger configuration file, which is a very privileged and unlikely scenario. It's so minor, we have chosen not to scan for it in our Log4shell scanning tool. We hope the focus will remain on fixing the far more critical vulnerabilities in earlier versions.

In this post, we'll look at the motivations and repercussions of hyping up this far less serious attack vector. Then, we'll look at a timeline of the vulnerabilities discovered in log4j, ending with this latest vulnerability.

· 8 min read
Forrest Allison

From the beginning of the log4shell issue, we have been delivering actionable advice and tools which can automatically find and fix Log4Shell. We were quick to see the seriousness of the vulnerability, and helped the community to coalesce into an organized remediation effort. From experience, we know that those responding to Log4Shell are in a stressful situation.

It's easy to imagine walking into a meeting and not being able to tell your boss if data has been leaked. Even worse, to not be able to say for sure if an attack has happened or not. While many are having these uncomfortable meetings about security, there has never been a better time to lobby for more attention to security and the installation of stronger defences.

We want to make it known that there are ways to protect data against attacks like Log4Shell. For the better part of a year, we've been building an Open Source framework to make it so these vulnerabilities, even full RCEs like Log4Shell, can't leak the sensitive data that attackers are really after. It feels more relevant now than ever.

· 7 min read
Free Wortley
Chris Thompson
Forrest Allison

Log4Shell Logo

The logo gets worse as the situation gets worse...

Originally Posted @ December 17th & Last Updated @ December 19th, 3:37pm PST

Earlier today, the second Log4j vulnerability (CVE-2021-45046), was upgraded from a CVSS score of 3.7 (limited DOS) to a CVSS score of 9.0 (limited RCE). Note: the reported limited RCE has only been proven to be exploitable on macOS at the moment. We expect, in time, that other operating systems will also be shown to be exploitable. Update: More operating systems have been showing to be vulnerable: MacOS, Fedora, Arch Linux, and Alpine Linux.

See the bottom of this post for an example exploit payload that bypasses the checks in log4j 2.15.0.

Just trying to patch Log4Shell? Please read our dedicated Mitigation Guide.

Context on CVE Timeline

The Log4j team had previously released version 2.15.0 on December 6th to address, which at the time had only been privately disclosed, the Log4Shell vulnerability that abused JNDI and LDAP to allow for an easily exploitable RCE vulnerability. We posted a blog post about this new RCE that, at the time, was only being posted about by the Chinese InfoSec community on December 9th, 2021. This post made the broader InfoSec community aware of the ongoing exploitation and resulted in a frenzy as Java developers worked to patch themselves.

The following day, on December 10th, an official CVE was associated with this RCE vulnerability as CVE-2021-44228 with the maximum possible CVSS score of 10.0.

In the days afterwards, it was realized that this fix was incomplete as bypasses were found that could result in a limited DOS for 2.15.0 users, and, for users that had patched older Log4j releases using formatMsgNoLookups, these bypasses could be used to allow for limited RCE.

Version 2.16.0 was released on December 13th to address the vulnerabilities by completely disabling JNDI by default. The next day, on December 14th, the second vulnerability was officially given a dedicated CVE numbered CVE-2021-45046 with a limited 3.7 (now 9.0).

In this post, we're going to talk about the impact of these changes, and about why the CVSS score has changed so drastically.

· 9 min read
Forrest Allison
Free Wortley

The worldwide scramble to fix the Log4Shell vulnerability has resulted in a number of paths to resolution without a single trusted, clear, and concise recommendation. Ever since our initial report on the Log4Shell vulnerability, we have made countless updates to our posts over the past week as more information has been uncovered and new vulnerabilities are found. Ideally, the narrative would be much clearer for a library which is so widely used.

We feel that the chaos which has followed the initial report of the Log4Shell vulnerability started with how the public patching of Log4j was handled on GitHub. This is a step-by-step guide for Open Source maintainers on how to handle the security patching process properly, using the Log4Shell incident as a retrospective.

· 11 min read
Chris Thompson

Writing a few lines of code is pretty easy. You might have taken an Intro to CS class or taught yourself from a programming language book, and eventually you became pretty comfortable going from an idea in your head to code that actually runs.

You probably have a GitHub account with a few personal projects that you work on occasionally when you feel inspired. Looking at the code after some time, you might ask yourself "did I really write this?" It's with a fresh perspective that you notice the same code copy and pasted a few times in odd places.

For a personal project, that's probably okay. For a professional project involving a team of developers, it can quickly become a painful problem.