The big bad wolf of the Log4j vulnerabilities. The vulnerability is exploited when a variant of the string ${jndi:ldap://\<attack_code>/a} is logged by Log4j. CVSS 10.0, RCE.

Not as big as CVE-2021-44228, but just as nasty. Requires non-standard Log4j configuration. CVSS 9.0, RCE and DoS.

Not as big as CVE-2021-44228, also a bit less nasty. CVSS 7.5, DoS

Applies only to Log4j version 1.x. Requires that Log4j uses JMSAppender. CVSS 6.6, RCE Exploitation requires that Log4j uses JMSAppender. Either because JMSAppender is configured directly - which is unusual - or because the attacker themselves adds it to the Log4j configuration. In addition, the attacker must have access to modify the JMSAppender configuration. If that is the case, the attacker would normally already have access to the system. The vulnerability is therefore considered of low relevance.

Applies only to Log4j version 1.x. Requires that Log4j uses SocketServer. CVSS 9.8, RCE Gives an attacker with network access to the relevant socket the ability to execute code. Exploit code is publicly available.

2. Build this text string ${jndi:ldap://<canarytoken>/a}
3. Enter this string in all fields that could potentially be logged

- User-agent
- Search fields
- Username
- ...

4. Follow up on canary hits and find out where log4j is running.

Ref: Tweet from Florian Roth

Windows

This covers all drives, including mapped network drives:

Get-PSDrive -PSProvider FileSystem | foreach {(gci ($_.Root) -rec -force -include *.jar -ea 0 | foreach {select-string "JndiLookup.class" $_} | select -exp Path)}

Ref: https://twitter.com/0gtweet/status/1469661769547362305

If you only want to check local drives:

Get-CimInstance win32_volume | Where-Object { $_.DriveType -eq 3 -and $_.DriveLetter -ne $null} | ForEach-Object {(gci ($_.DriveLetter+"\") -rec -force -include *.jar -ea 0 | foreach {select-string "JndiLookup.class" $_} | select -exp Path)}

Ref: https://twitter.com/webmastir/status/1470386184052486155?s=20

If you also want to check the event log on the machine.

Get-WinEvent -ListLog * |
  foreach { get-winevent @{logname=$_.logname; } -ea 0 } |
  where message -match 'jndi'

Linux #1

#!/bin/bash
find / -name '*log4j*.jar' -print0 2>/dev/null -print0 | while read -d $'\0' log4j; do
        echo -en "${log4j}: "$(unzip -p "${log4j}" | strings | grep -Po '^Implementation-Version:\s+([0-9\.]+)' | awk '{ print $NF }')"\n"
done
exit 0

Run as root

Linux #2

lsof | grep log4j-core

Java 8

Update Log4j to v 2.17.0

Java 7

Update Log4j to v 2.12.2 NOTE does not mitigate CVE-2021-45105

⚠️ This method is no longer considered a complete solution as it does not mitigate all vulnerabilities in all situations.

Windows

[Environment]:https://raw.githubusercontent.com/helsecert/cve-2021-44228/main/:SetEnvironmentVariable(%22LOG4J_FORMAT_MSG_NO_LOOKUPS%22,%22true%22,%22Machine%22)

NOTE: Requires restart

From https://twitter.com/CyberRaiju/status/1469505680138661890

Set JVM flag

"‐Dlog4j2.formatMsgNoLookups=True"

Command line example:

JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true" teku --network mainnet

Or with an -Xmx value:

JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true -Xmx4g" teku

Systemd config example:

Environment='JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true"'

Or with an -Xmx value:

Environment='JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true" "-Xmx4g'

This is loaded upon application restart From https://github.com/ConsenSys/teku/security/advisories/GHSA-mwfw-vm54-g3p7

A jar file is an archive (zip file) and can be opened. Files can then be removed. This can be done manually with tools like 7-zip (see image) or by using a script.

Requires application restart

Ref: https://mogwailabs.de/en/blog/2021/12/vulnerability-notes-log4shell/9

Windows

[Reflection.Assembly]:https://raw.githubusercontent.com/helsecert/cve-2021-44228/main/:LoadWithPartialName(%27System.IO.Compression%27)
$JarFilLokasjon = 'C:\temp\log4j-core-2.13.0-test.jar'
$Filnavn   = 'JndiLookup.class' #Denne filen slettes!

$Stream = New-Object IO.FileStream($JarFilLokasjon, [IO.FileMode]::Open)
$ZipMode   = [IO.Compression.ZipArchiveMode]::Update
$Zip    = New-Object IO.Compression.ZipArchive($stream, $ZipMode)

($zip.Entries | Where-Object { $Filnavn -contains $_.Name }) | ForEach-Object { $_.Delete() }
$zip.Dispose()
$stream.Close()
$stream.Dispose()

Linux

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class