probablysecure/triage-cve-2021-44228-log4shell-log4j-Goal is to triage well known attack and learn how security teams quickly respond.
For this lab, the goal was to triage another well-known real-world vulnerability, Log4Shell, one of the most widely exploited vulnerabilities in recent years due to how common the affected library was across enterprise software.
I went to the National Vulnerability Database and looked up the CVE:
https://nvd.nist.gov/vuln/search#/nvd/home?resultType=records
I searched for CVE-2021-44228 and opened the result page.
After reading through the description, I answered a few basic questions to understand what's actually at risk:
I found the CVSS score and vector string listed on the page:
I went through the vector string piece by piece to see what each part actually meant:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
This is about as bad as a vector string gets: no privileges needed, no user interaction, reachable over the network, and it can even affect things outside the vulnerable component itself (Scope: Changed). That combination is part of why Log4Shell was treated as such an urgent, widespread issue when it was disclosed.
I checked the Weakness Enumeration section on the NVD page for this CVE.
The CWE listed is CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement. In plain terms, this means the software takes input and evaluates it as part of an expression without properly checking it first, which is what let attackers slip in malicious JNDI lookups through normal log messages.
I considered whether I'd treat this as higher or lower risk under two different scenarios.
Scenario 1: The vulnerable software is live and reachable. Higher risk. This vulnerability lets an attacker access and modify EL (Expression Language) statements, directly affecting confidentiality and integrity.
Scenario 2: The vulnerable software is installed on a machine that's powered off and not reachable. Lower risk. If the vulnerable software can't be reached at all, confidentiality and integrity stay intact since there's no way for an attacker to interact with it.
Out of the CVEs I've triaged so far, this one stood out for how little an attacker needs to exploit it, no privileges, no user interaction, just network access, paired with the fact that the vulnerability could affect systems beyond the component itself. It's a good example of why Log4Shell caused such a widespread scramble across the industry when it came out.