CVE-2024-12798

Overview

Logback is an open-source Java logging framework designed as a successor to Log4j. Its core module provides logging infrastructure, logback-classic implements the SLF4J API, and logback-access supplies HTTP access logging for servlet containers.

An arbitrary code execution vulnerability (CVE-2024-12798) has been identified in the Logback JaninoEventEvaluator, which allows attackers who can modify an existing Logback configuration file, or inject an environment variable that points the application to a malicious one, to execute arbitrary Java code. The attack requires existing privilege on the host.

Per OWASP: Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application.

This issue affects multiple versions of Logback.

Details

Module Info

• Product: Logback
• Affected packages: ch.qos.logback:logback-core
• Affected versions: <1.3.15, >=1.4.0 <1.5.13
• GitHub repository: https://github.com/qos-ch/logback
• Published packages: https://central.sonatype.com/artifact/ch.qos.logback/logback-core
• Package manager: Maven
• Fixed in:
  • OSS Logback 1.3.15, 1.5.13
  • NES for Logback v1.2.15

Vulnerability Info

This Medium-severity vulnerability is found in the ch.qos.logback:logback-core package in multiple versions of Logback. Logback configuration files can attach an event evaluator to filters and appenders through the <evaluator> element, and when no class is given the default evaluator is JaninoEventEvaluator. Its base class, JaninoEventEvaluatorBase, takes the <expression> text from the configuration and compiles it with the Janino ScriptEvaluator when the evaluator starts:

@Override
public void start() {
    try {
        assert context != null;
        scriptEvaluator = new ScriptEvaluator(getDecoratedExpression(), EXPRESSION_TYPE, getParameterNames(), getParameterTypes(), THROWN_EXCEPTIONS);
        super.start();
    } catch (Exception e) {
        addError("Could not start evaluator with expression [" + expression + "]", e);
    }
}

The classic evaluator only prepends return and an import to the configured text before handing it to Janino:

protected String getDecoratedExpression() {
    String expression = getExpression();
    if (!expression.contains("return")) {
        expression = "return " + expression + ";";
        addInfo("Adding [return] prefix and a semicolon suffix. Expression becomes [" + expression + "]");
        addInfo("See also " + CoreConstants.CODES_URL + "#block");
    }
    return IMPORT_LEVEL + expression;
}

No restriction is placed on what the expression may contain, so any Java statement is compiled and then run by evaluate() for every logging event that reaches the evaluator. When Janino is on the classpath, an attacker who can write a Logback configuration file, or redirect the application to one through an environment variable before startup, can therefore place arbitrary Java code in an <expression> element and have it executed with the privileges of the application.

Mitigation

Logback 1.2.x is End-of-Life and will not receive any updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported version of Logback.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• 7asecurity (finder)