CVE-2020-9493

Overview

Apache Chainsaw is a visualization and monitoring application used for analyzing logs generated by the Log4j framework. Chainsaw provides multiple ways to receive logs over network sockets, including serialized Java objects transmitted remotely.

‍

A critical remote code execution vulnerability (CVE-2020-9493) was caused by unsafe deserialization of untrusted data received over network connections. An attacker can craft malicious serialized Java objects that Chainsaw will deserialize automatically, resulting in arbitrary code execution.

‍

This flaw also indirectly impacts Apache Log4j 1.x, which contains similar receiver logic (such as SocketReceiver, JMSSink, and Chainsaw-compatible appenders) that perform unsafe deserialization of log events. Because Log4j 1.x is end-of-life, it never received a fix, leaving applications using Chainsaw-related components exposed to remote code execution.

‍

Per OWASP: Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application. This type of attack exploits poor handling of untrusted data. These types of attacks are usually made possible due to a lack of proper input/output data validation.

‍

This vulnerability is considered critical and can be exploited without authentication when Chainsaw or Log4j1 socket receivers are exposed to untrusted networks.

‍

Details

Module Info

• Product: Apache Log4j
• Affected packages: log4j
• Affected versions: >= 1.2, <= 1.2.17
• GitHub repository: https://github.com/apache/logging-log4j1
• Published packages: https://central.sonatype.com/artifact/log4j/log4j
• Package manager: Maven
• Fixed In: NES for Apache Log4j v1.2.18

‍

Vulnerability Info

This critical vulnerability is caused by unsafe deserialization of untrusted Java objects transmitted to Chainsaw or Log4j1 receivers. When enabled, these components automatically deserialize incoming network data as log events. An attacker can send a specially crafted serialized payload that triggers:

‍

• arbitrary code execution
• full remote system compromise
• takeover of the logging host
• execution of attacker-supplied classes

‍

Because many deployments historically exposed Chainsaw receivers on internal networks without robust filtering or authentication, exploitation can occur with minimal effort.

‍

Log4j 1.x shares the same deserialization logic for Chainsaw compatibility and remains vulnerable because the project reached end-of-life in 2015.

Steps To Reproduce

• Deploy a vulnerable instance of the log visualization utility and enable a network-based receiver to listen for serialized event streams.
• Generate a malicious serialized object payload utilizing a gadget chain capable of invoking system-level commands upon reconstruction.
• Transmit the byte stream to the listening service to trigger an unauthenticated deserialization process that executes the embedded command on the host.

‍

Mitigation

Apache Log4j 1.x has been end-of-life since 2015 and no longer receives community updates. Users of the affected component should apply one of the following mitigations:

‍

Users of Log4j 1.x should apply the following mitigations:

• Upgrade affected applications to supported versions of Log4j
• Leverage a commercial support partner like HeroDevs for post-EOL security support
• Disable Chainsaw receivers and Log4j 1.x SocketReceiver/JMSSink functionality
• Avoid deserialization-based log transport mechanisms
• Migrate to Log4j 2.x, which does not expose this vulnerability

‍