What is Log4j? Log4j Vulnerability FAQs

In December 2021, a Log4j vulnerability was discovered, and it turned out to be a serious problem for IT professionals from all over the world. According to WIRED, hundreds of millions of servers, beginning from tech giants (like Google, Microsoft or Apple) to game servers like Minecraft, were at risk of this vulnerability. As a result, the vulnerability was assigned a CVSS severity scoring of 10 (maximum).

What is Log4?

Log4j (short for “Log for Java”) is a popular open source Java-based logging framework that provides a flexible and efficient way to manage and create log messages in Java applications. It was originally developed by the Apache Software Foundation and has become the de facto standard for logging in Java applications.

Its main advantage is flexibility, ease of use and versatility. Therefore, it is used in a variety of projects: from LinkedIn to Steam.

Hundreds of websites and applications use Log4j to perform important operations such as logging data for debugging and other purposes. When you enter or click on a bad online link and get a 404 error notification, this is a common example of Log4j at work. The web server hosting the domain of the web link you tried to access informs you that the web page does not exist.

What is Log4j vulnerability?

In December 2021, Log4j was compromised: 3 vulnerabilities were identified in turn, the first of which was named Log4Shell (CVE-2021-45105).

Large-scale attacks began on December 9, when the Log4j exploit was publicly released using the POC.

The vulnerability allowed attackers to carry out remote code execution. Malicious commands were registered as legitimate. This allowed everyone to do almost anything: steal data, distribute malicious URLs, and actually control entire servers.

December 9 was the so-called 0-day, that is, the day when data about the flaw in the Log4j libraries were made public.

So, the Apache Log4j vulnerability (also known as Log4Shell, aka CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105) is a critical flaw in software that allows attackers to run unauthorized remote code by simply sending a logging command a specific line.

To use Log4j, an attacker only needs to force the system to log a special line of code. From there, he can upload arbitrary code to the target server and install malware or launch other attacks.
To deliver the source code, the hackers could have used any method that would show up in the log, such as sending a string in an email or setting it as the username of an account.

Even a user without specific knowledge and skills could use this exploit, and this endangered even small niche services.

To summarize, the main threats of the Log4j vulnerability are:

1. Remote Code Execution (RCE)
   (It is the potential for attackers to remotely execute arbitrary code on affected systems).
2. In many cases, the vulnerability can be exploited without the need for authentication or credentials. That’s why attackers can potentially gain unauthorized access without any obstacles.
3. A wide range of affected systems (since Log4j is an extremely popular logging).
4. Exploiting the Log4j vulnerability does not require a high level of knowledge.
5. Due to the widespread use of Log4j, the vulnerability may also affect software that indirectly uses Log4j as a dependency, putting the chain at risk.

Here are some Log4j vulnerability FAQs (frequently asked questions):

1. What products are affected by the Log4j vulnerability?
   Many applications and systems using versions of Log4j 2.x prior to version 2.16.0 are affected. This includes a wide range of Java-based applications, web servers, etc.
2. What is the impact of the Log4j vulnerability?
   The impact can be severe as attackers can remotely execute arbitrary code on affected systems. This can lead to data leakage, system compromise and unauthorized access.
3. Is there a fix for the Log4j vulnerability?
   The Apache Logging Services Project has released patches to address this vulnerability. To apply the fix, organizations should update Log4j to version 2.17.1.
4. What are the potential consequences of not fixing the vulnerability?
   If the Log4j vulnerability is not addressed, systems could be subject to remote code execution attacks, leading to unauthorized access, data leakage, and compromise of sensitive information.
5. Where can I get more information about the Log4j vulnerability?
   Official sources such as the Apache Logging Services Project, security advisories, and cybersecurity organizations provide detailed information about the vulnerability, its impact, and mitigation steps. Visit the Log4j home page for more information about Log4j and the Log4j vulnerability.

It’s important to remember that staying informed and applying security patches and updates in a timely manner is critical to keeping your systems and applications secure.

To ensure that your company data is always safe, consider professional IT support, provided by cyber-security professionals.

Klik Solution is a Managed security service provider, specialized among other in Computer management in Maryland. From antivirus software to endpoint detection & response tools, your cyber security needs will be addressed in the best possible way. Contact us today for a comprehensive consultation.