CVE-2020-9488

Overview

Apache Log4j is a widely used Java-based logging framework for enterprise applications, offering a variety of appenders to route log events to external systems, including email via SMTP.

‍

A vulnerability (CVE-2020-9488) has been identified in the SMTP Appender of Log4j versions prior to 2.13.2. When configured to send logs over SMTPS (SMTP over TLS), the SMTP Appender failed to properly validate the server certificate's hostname. As a result, a certificate with a mismatched host value could still be accepted, weakening the security guarantees of TLS.

‍

Per OWASP: The Manipulator-in-the middle attack (MITM) intercepts communication between two systems. For example, in an http transaction the target is the TCP connection between client and server. Using different techniques, the attacker splits the original TCP connection into 2 new connections, one between the client and the attacker and the other between the attacker and the server. Once the TCP connection is intercepted, the attacker acts as a proxy, being able to read, insert and modify the data in the intercepted communication.

‍

In affected Log4j versions, a MITM positioned between the application and the SMTP server could intercept and read log messages transmitted over SMTPS, potentially exposing sensitive information contained in logs.

‍

Details

Module Info

• Product: Apache Log4j
• Affected packages: log4j
• Affected versions: >= 1.0, <= 1.2.17
• GitHub repository: https://github.com/apache/logging-log4j1
• Published packages: https://central.sonatype.com/artifact/log4j/log4j
• Package manager: Maven
• Fixed In: NES for Apache Log4j v1.2.18

‍

Vulnerability Info

The SMTP Appender used for sending log messages over SMTPS did not correctly validate the hostname presented in the server’s TLS certificate. By not enforcing host name matching, the TLS handshake could succeed even when the certificate belonged to a different host.

‍

This flaw enables a man-in-the-middle attacker positioned between the application and its SMTP server to:

• intercept encrypted log messages
• read or alter sensitive logged information
• impersonate a legitimate SMTP server
• weaken the confidentiality of logging pipelines

‍

The vulnerability does not enable remote code execution, but it compromises the security of log transport channels and may expose sensitive operational or user data contained in logs.

‍

With modern Java versions and their default security assumptions this vulnerability is difficult to exploit unless you’re explicitly turning certificate verification off or using old versions of Java that allow using older, insecure versions of TLS.

Steps To Reproduce

• Establish a local mail transfer service utilizing a self-signed certificate to simulate an encrypted communication endpoint.
• Configure the logging framework to utilize a mail-based appender specifically forced to use an implicit secure transport protocol.
• Dispatch a high-severity log event to confirm that the handshake succeeds and data is transmitted without the client validating the authenticity of the server's certificate.

‍

Mitigation

Apache Log4j 1.x has been end-of-life since 2015 and no longer receives community updates.

‍

Users of Log4j 1.x should apply the following mitigations:

• Upgrade affected applications to supported versions of Log4j
• Leverage a commercial support partner like HeroDevs for post-EOL security support
• Enforce strict certificate validation policies in SMTP infrastructure
• Avoid sending sensitive data via email appenders, especially over untrusted networks
• Use secure logging pipelines that support strong TLS validation

‍