CVE-2021-44228 : Security Advisory and Response

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints.

Understanding CVE-2021-44228

Apache Log4j2 2.0-beta9 through 2.15.0 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints, enabling arbitrary code execution.

What is CVE-2021-44228?

The vulnerability in Apache Log4j2 allows attackers to execute arbitrary code when controlling log messages or parameters, which has been mitigated in version 2.16.0.

The Impact of CVE-2021-44228

Attackers can execute arbitrary code loaded from LDAP servers with enabled message lookup substitution.
Versions 2.15.0 and earlier are affected, with the issue fixed in version 2.16.0.

Technical Details of CVE-2021-44228

The technical aspects of CVE-2021-44228 affecting Apache Log4j2.

Vulnerability Description

Apache Log4j2 versions 2.0-beta9 through 2.15.0 are vulnerable to arbitrary code execution via attacker-controlled log messages or parameters.

Affected Systems and Versions

Vendor: Apache Software Foundation
Product: Apache Log4j2
Affected Versions: 2.0-beta9 to 2.15.0

Exploitation Mechanism

Attackers exploit the issue by providing malicious input through log messages or parameters, enabling code execution from LDAP servers.

Mitigation and Prevention

Steps to prevent and mitigate the CVE-2021-44228 vulnerability.

Immediate Steps to Take

Update Apache Log4j2 to version 2.16.0 or later.
Disable message lookup substitution to prevent arbitrary code execution.

Long-Term Security Practices

Regularly monitor security advisories for patches and updates.
Maintain up-to-date versions of all software components.

Patching and Updates

Apply patches provided by Apache Software Foundation to address the vulnerability effectively.