CVE-2019-17571
This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.
Overview
Apache Log4j is a Java-based logging framework that provides flexible logging capabilities for enterprise applications. Its plugin architecture and configuration options made it a popular choice for JVM-based systems for many years, particularly before the introduction of Log4j 2.x.
A remote code execution vulnerability (CVE-2019-17571) has been identified in Apache Log4j 1.x, specifically within the SocketServer component. When the Log4j 1.x SocketServer is enabled, the server listens for serialized log events transmitted over a socket. Due to insecure deserialization, attackers may send crafted serialized objects that trigger arbitrary code execution on the target system.
Per OWASP: Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application. This type of attack exploits poor handling of untrusted data. These types of attacks are usually made possible due to a lack of proper input/output data validation.
This issue affects all Log4j 1.2 versions and is considered a critical security risk.
Details
Module Info
- Product: Apache Log4j
- Affected packages: log4j
- Affected versions: >= 1.2, <= 1.2.17
- GitHub repository: https://github.com/apache/logging-log4j1
- Published packages: https://central.sonatype.com/artifact/log4j/log4j
- Package manager: Maven
- Fixed In: NES for Apache Log4J v1.2.18
Vulnerability Info
This critical vulnerability is caused by insecure deserialization of untrusted data received by the Log4j 1.x SocketServer. An attacker can transmit a malicious serialized payload that executes arbitrary code when processed by the server. Since Log4j 1.x has reached end-of-life, the Apache Software Foundation does not provide patches for this issue.
Mitigation
Apache Log4j 1.x has been end-of-life since 2015 and no longer receives community updates. Users of the affected component should apply one of the following mitigations:
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Log4j
- Leverage a commercial support partner like HeroDevs for post-EOL security support
- Remove or disable use of SocketServer within Log4j 1.x
- Upgrade applications to supported versions such as Log4j 2.x
