Log4j vulnerability - Apache Log4j Vulnerability (CVE-2021-45046)

Hello everyone,

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. This vulnerability is patched in Log4j version 2.12.2 and 2.16.0. All versions from 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0, are vulnerable.

[EDIT] A new update is released on this vulnerability. Remote Code Execution (RCE) is still possible through bypassing the disabled lookup patch released in 2.15.0 and making a remote lookup connection to external malicious servers.

Resolution:

If you're running any software, especially web server applications, that uses Log4j versions from 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0, kindly contact the respective software vendor for a patch or mitigation. For more details on mitigation, refer to this document.

To detect your network systems with web server installations that are affected by this vulnerability,

1) Log in to the Vulnerability Manager Plus web console.

2) Navigate to Threats > Web server misconfigurations

3) Search for "Apache Log4j Vulnerability (CVE-2021-45046)" to find affected Windows systems and "Apache Log4j Vulnerability (CVE-2021-45046) For Linux" to find affected Linux systems.

4) Under the affected systems column, you'll get a total count of systems affected by this vulnerability.

5) Clicking on it will reveal the affected systems.

6) To view the exact web server installations on those systems that are affected by this vulnerability, click on the web server misconfiguration count available for each system.

7) In the resulting table view, the "file path" column displays the file path of the web servers affected by the Apache Log4j Vulnerability (CVE-2021-45046).

Alternatively, you can view all the affected systems in your network along with vulnerable web server installations on those systems in a report using a custom query. To do so,

1) Navigate to Reports > Query reports.

2) Click on New Query Report

3) Use the below custom query based on your database type:

For pgsql setup: 
Select H.HARDENINGNAME as "Hardening Name",H.DESCRIPTION as "Description",H.FIXDESCRIPTION as "Resolution", hgd.name as "Category", STRING_AGG(distinct(rwh.FilePath),', ') as "File Path", pms.name as "Severity",STRING_AGG(distinct(Resource.name),', ')  as Computer_Name from ResourceToWebHardening RWH inner join Hardening H on RWH.HardeningId=H.HardeningId inner join HardeningToGroupRel hgr on h.HardeningId=hgr.hardeningId inner join HardeningGroupDetails hgd on hgr.GroupId=hgd.GroupId inner join Resource on RWH.Resource_Id=Resource.Resource_Id inner join PMSeverity pms on H.Severity=pms.SeverityId where H.HardeningId in (380,1152) GROUP BY H.HARDENINGNAME,H.DESCRIPTION,H.FIXDESCRIPTION ,hgd.name,pms.name

For MSSQL setup:

Select H.HARDENINGNAME as "Hardening Name",H.DESCRIPTION as "Description",H.FIXDESCRIPTION as "Resolution", hgd.name as "Category",rwh.FilePath as "File Path", pms.name as "Severity",Resource.name as "Computer_Name" from ResourceToWebHardening RWH inner join Hardening H on RWH.HardeningId=H.HardeningId inner join HardeningToGroupRel hgr on h.HardeningId=hgr.hardeningId inner join HardeningGroupDetails hgd on hgr.GroupId=hgd.GroupId inner join Resource on RWH.Resource_Id=Resource.Resource_Id inner join PMSeverity pms on H.Severity=pms.SeverityId where H.HardeningId in (380,1152) GROUP BY H.HARDENINGNAME,H.DESCRIPTION,H.FIXDESCRIPTION ,hgd.name,pms.name,rwh.FilePath,Resource.name

Cheers,

The ManageEngine Team