Bad things come in threes: Apache reveals another Log4J bug
(2021/12/19)
- Reference: 1639954646
- News link: https://www.theregister.co.uk/2021/12/19/log4j_new_flaw_cve_2021_45105/
- Source link:
The Apache Software Foundation (ASF) has revealed a third bug in its Log4 Java-based open-source logging library Log4j.
CVE-2021-45105 is a 7.5/10-rated infinite recursion bug that was present in Log4j2 versions 2.0-alpha1 through 2.16.0. The fix is version 2.17.0 of Log4j.
That’s the third new version of the tool in the last ten days.
[1]
In case you haven’t been paying attention, version 2.15.0 was created to fix [2]CVE-2021-44228 , the critical-rated and trivial-to-exploit remote code execution flaw present in many versions up to 2.14.0.
[3]CISA issues emergency directive to fix Log4j vulnerability
[4]Over Log4j? VMware has another critical flaw for you to patch
[5]As CISA tells US govt agencies to squash Log4j bug by Dec 24, fingers start pointing at China, Iran, others
But version 2.15.0 didn’t address another issue - [6]CVE-2021-45046 - which allowed a remote attacker with control over Thread Context Map (MDC) to cook up malicious input using a JNDI Lookup pattern. The result could be remote code execution, thankfully not in all environments.
Version 2.16.0 fixed that problem.
[7]
[8]
But it didn’t fix CVE-2021-45105, which the ASF [9]describes as follows:
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}) , attackers with control over Thread Context Map input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process.
Vendor-agnostic bug bounty program the Zero Day Initiative has described the flaw as follows.
When a nested variable is substituted by the StrSubstitutor class, it recursively calls the substitute() class. However, when the nested variable references the variable being replaced, the recursion is called with the same string. This leads to an infinite recursion and a DoS condition on the server.
What to do?
You know the drill by now: download the latest version 2.17.0 of Log4J, [10]here , and install it everywhere Log4j runs, which of course turns out to be everywhere (including in some hard-to-find places).
The ASF has also outlined the following mitigations:
In PatternLayout in the logging configuration, replace Context Lookups like ${ctx:loginId}or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC) .
Otherwise, in the configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.
Once you’re done, cross your fingers and hope the ASF has found all the flaws that need immediate fixes so we can all stop worrying about this piece of software over Christmas. ®
Get our [11]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yb@5lq-DHvkR5VD3A0F35wAAAAM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2021/12/13/log4j_rce_latest/
[3] https://www.theregister.com/2021/12/17/cisa_issues_emergency_directive_to/
[4] https://www.theregister.com/2021/12/17/vmware_criticial_uem_flaw/
[5] https://www.theregister.com/2021/12/15/log4j_latest_cisa/
[6] https://www.theregister.com/2021/12/14/apache_log4j_2_16_jndi_disabled/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yb@5lq-DHvkR5VD3A0F35wAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yb@5lq-DHvkR5VD3A0F35wAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://logging.apache.org/log4j/2.x/
[10] https://logging.apache.org/log4j/2.x/download.html
[11] https://whitepapers.theregister.com/
CVE-2021-45105 is a 7.5/10-rated infinite recursion bug that was present in Log4j2 versions 2.0-alpha1 through 2.16.0. The fix is version 2.17.0 of Log4j.
That’s the third new version of the tool in the last ten days.
[1]
In case you haven’t been paying attention, version 2.15.0 was created to fix [2]CVE-2021-44228 , the critical-rated and trivial-to-exploit remote code execution flaw present in many versions up to 2.14.0.
[3]CISA issues emergency directive to fix Log4j vulnerability
[4]Over Log4j? VMware has another critical flaw for you to patch
[5]As CISA tells US govt agencies to squash Log4j bug by Dec 24, fingers start pointing at China, Iran, others
But version 2.15.0 didn’t address another issue - [6]CVE-2021-45046 - which allowed a remote attacker with control over Thread Context Map (MDC) to cook up malicious input using a JNDI Lookup pattern. The result could be remote code execution, thankfully not in all environments.
Version 2.16.0 fixed that problem.
[7]
[8]
But it didn’t fix CVE-2021-45105, which the ASF [9]describes as follows:
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}) , attackers with control over Thread Context Map input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process.
Vendor-agnostic bug bounty program the Zero Day Initiative has described the flaw as follows.
When a nested variable is substituted by the StrSubstitutor class, it recursively calls the substitute() class. However, when the nested variable references the variable being replaced, the recursion is called with the same string. This leads to an infinite recursion and a DoS condition on the server.
What to do?
You know the drill by now: download the latest version 2.17.0 of Log4J, [10]here , and install it everywhere Log4j runs, which of course turns out to be everywhere (including in some hard-to-find places).
The ASF has also outlined the following mitigations:
In PatternLayout in the logging configuration, replace Context Lookups like ${ctx:loginId}or $${ctx:loginId} with Thread Context Map patterns (%X, %mdc, or %MDC) .
Otherwise, in the configuration, remove references to Context Lookups like ${ctx:loginId} or $${ctx:loginId} where they originate from sources external to the application such as HTTP headers or user input.
Once you’re done, cross your fingers and hope the ASF has found all the flaws that need immediate fixes so we can all stop worrying about this piece of software over Christmas. ®
Get our [11]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yb@5lq-DHvkR5VD3A0F35wAAAAM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2021/12/13/log4j_rce_latest/
[3] https://www.theregister.com/2021/12/17/cisa_issues_emergency_directive_to/
[4] https://www.theregister.com/2021/12/17/vmware_criticial_uem_flaw/
[5] https://www.theregister.com/2021/12/15/log4j_latest_cisa/
[6] https://www.theregister.com/2021/12/14/apache_log4j_2_16_jndi_disabled/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yb@5lq-DHvkR5VD3A0F35wAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yb@5lq-DHvkR5VD3A0F35wAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://logging.apache.org/log4j/2.x/
[10] https://logging.apache.org/log4j/2.x/download.html
[11] https://whitepapers.theregister.com/