Log4j Security Vulnerability - CVE-2021-44228 | CVE-2021-45046

Current status: December 16, 2021 - 2:15 p.m. (CET)

Background

Log4j is a popular logging library for Java applications. It is used for the high-performance aggregation of an application’s log data.

The blog of an IT security service provider reports on the vulnerability CVE-2021-44228 in Log4j versions 2.0 through 2.14.1, which could potentially allow attackers to execute their own code on the target system and thus compromise the server. This risk exists when Log4j is used to log a string controlled by the attacker, such as the HTTP User Agent.

A proof-of-concept (PoC) for the vulnerability was published on GitHub and shared on Twitter. In addition to the PoC, there are also examples of scripts that randomly scan systems for vulnerabilities. While scripts of this kind cannot provide administrators with certainty regarding the vulnerability, they do allow attackers to perform rudimentary scans for vulnerable systems in the short term.

This critical vulnerability may therefore affect all Java applications accessible from the Internet that use Log4j to log parts of user requests.

Update December 15, 2021:

The vulnerability CVE-2021-4428 was fixed in Apache Log4j version 2.15.0, but this fix simultaneously introduced another security vulnerability, described in CVE-2021-45046. The vulnerability described in CVE-2021-45046 was fixed in Log4j version 2.16.0. The additional vulnerability that arose does not affect the necessary steps described below.

Affected Managed Elasticsearch Servers

Elasticsearch is not vulnerable to remote code execution due to this vulnerability, as Elasticsearch uses the Java Security Manager. Elasticsearch running with JDK 8 or lower is only vulnerable to a DNS information leak, which can be fixed by simply changing the JVM properties.

The information leak does not allow access to data within the Elasticsearch cluster. Elasticsearch has already released versions 7.16.1 and 6.8.21, which include the necessary JVM property by default and remove certain components of Log4j for security reasons.

Required Actions

Managed Elasticsearch Servers

No action is required if you are using a Managed Elasticsearch Server.

All Managed Elasticsearch Servers use the Java Security Manager and at least JDK version 16 and are therefore not vulnerable to the security vulnerability or the DNS leak.

Standalone Elasticsearch Installations

If you have installed Elasticsearch standalone on your server, you must ensure that the JDK version you are using is at least version 9.

Checking Installed Versions

You can check the installed JDK version as follows:

/usr/share/elasticsearch/jdk/bin/java --version

openjdk 17.0.1 2021-10-19
OpenJDK Runtime Environment Temurin-17.0.1+12 (build 17.0.1+12)
OpenJDK 64-bit Server VM Temurin-17.0.1+12 (build 17.0.1+12, mixed mode, sharing)

You can check the installed Elasticsearch version as follows:

apt list elasticsearch

elasticsearch/stable,now 7.16.1 amd64  [installed]

The active Elasticsearch version can be checked as follows:

apt update && apt install curl

curl -XGET 'http://localhost:9200'

{
  "name" : "s*****.creolineserver.com",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "*********",
  "version" : {
    "number" : "7.16.1",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "5b38441b16b1ebb16a27c107a4c3865776e20c53",
    "build_date" : "2021-12-11T00:29:38.865893768Z",
    "build_snapshot" : false,
    "lucene_version" : "8.10.1",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

You can check the installed Kibana version as follows:

apt list kibana

kibana/stable,now 7.16.1 amd64  [installed]

Identifying Java Processes

If you are unsure whether a Java-based process is running on your server, you can use the shell command ps aux | grep java to check if any Java processes are running in the background.

ps aux | grep java

USER PID %CPU %MEM    VSZ   RSS TTY STAT START   TIME COMMAND
root     12157  0.0  0.0   6088   892 pts/0    R+   12:21   0:00 grep java
elastic+ 28739  3.7 63.8 6899160 2539176 ?     Ssl  10:11   4:53 /usr/share/elasticsearch/jdk/bin/java -Xshare:auto [..]

In this example, an Elasticsearch process is running. (/usr/share/elasticsearch/jdk/bin/java)

Identifying Java Network Services

If you are unsure whether a Java-based network service is running on your server, you can use the shell command netstat -tulpn |grep java to determine whether services are being provided by Java-based applications.

netstat -tulpn |grep java

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp6 0 0 :::9200 :::* LISTEN 28739/java
tcp6 0 0 :::9300 :::* LISTEN 28739/java

In this example, the Elasticsearch ports 9200 and 9300 are open via Java.

Further Inquiries

If you are unsure whether your creoline server provides Java-based services that are affected by this vulnerability, please contact our support team immediately so that we can determine what specific measures need to be taken for your server.

Sources