Enterprise Technology & Services is cognizant of the Apache Log4j vulnerability, announced on Friday, Dec 10th. ET&S team is actively working to identify all the assets, affected by the vulnerability, so they can apply all the necessary patches. In some cases, you may be asked to upgrade Apache software installed. Please be sure to comply to protect the University systems and resources. If you have questions or concerns, please contact your local Help Desk team.
MS-ISAC ADVISORY NUMBER:
2021-158
DATE(S) ISSUED:
12/10/2021
SUBJECT:
A Vulnerability in Apache Log4j Could Allow for Arbitrary Code Execution
OVERVIEW:
A vulnerability has been discovered in Apache Log4j, a very ubiquitous logging package for Java. Successful exploitation of this vulnerability could allow for arbitrary code execution within the context of the systems and services that use the Java logging library, including many services and applications written in Java. Depending on the privileges associated with these systems and services, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If these systems and services have been configured to have fewer user rights, exploitation of this vulnerability could have less impact than if they were configured with administrative rights.
THREAT INTELLIGENCE:
According to numerous open source reports, Log4j is used with Apache software like Apache Struts, Solr, Druid, along with other technologies. Many websites of manufacturers and providers have been found to be affected including Apple, Twitter, Steam, Tesla and more. Threat actors will likely include payloads in simple HTTP connections, either in a User-Agent header or trivial POST form data. In addition, it has been reported that organizations are already seeing signs of exploitation in the wild with further attempts on other websites likely.
SYSTEMS AFFECTED:
- Apache Log4j between versions 2.0 and 2.14.1
- TECHNICAL SUMMARY:
-
A vulnerability has been discovered in Apache Log4j, a very ubiquitous logging package for Java. This vulnerability resides in the JNDI lookup feature of the log4j library. The JNDI lookup feature of log4j allows variables to be retrieved via JNDI - Java Naming and Directory Interface. This is an API that provides naming and directory functionality to Java applications. While there are many possibilities, the log4j API supports LDAP and RMI (Remote Method Invocation).
Successful exploitation of this vulnerability could allow for arbitrary code execution within the context of the systems and services that use the Java logging library, including many services and applications written in Java. Depending on the privileges associated with these systems and services, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If these systems and services have been configured to have fewer user rights, exploitation of this vulnerability could have less impact than if they were configured with administrative rights.
RECOMMENDATIONS:
We recommend the following actions be taken:
Apply the latest patches (version 2.15.0) provided by Apache after appropriate testing.
Run all systems and services as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
Apply the Principle of Least Privilege to all systems and services.
