Catch vulnerabilities in your projects, automatically on every pull request. Try Sonatype Lift for free. Install Lift

Vulnerability

CVE-2021-4104
CVSS Score 8.1 Critical

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality Impact

High

Integrity Impact

High

Availability Impact

High

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Not Recorded

Description

[CVE-2021-4104] JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when...

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. =================================================== The following information is provided by Sonatype Nexus Intelligence. Nexus Intelligence is the only security research service that performs "secondary expansion" to determine if newly discovered vulnerabilities are also present in other components. Learn more about Nexus Intelligence -- https://www.sonatype.com/products/intelligence =================================================== Explanation --------------------------------------------------- The `log4j:log4j` package is vulnerable to Deserialization of Untrusted Data. The `lookup()` and `activateOptions()` methods in the `JMSAppender` class allow `JNDI` lookup requests to be made when the `TopicBindingName` and `TopicConnectionFactoryBindingName` specify a trusted host. Lookups made to this host may be used by attackers to request a serialized malicious Java Object that can be deserialized and executed, leading to Remote Code Execution (RCE). Note that this vulnerability is different from CVE-2021-44228 and requires the attacker to be in control of the third party host that is specified in the configuration, or write access to the Log4j configuration file in order to specify a malicious lookup host directly. This vulnerability also only affects the 1.x.x component of `Log4j` released under the `log4j:log4j` group and artifact IDs. *Advisory Deviation Notice:* The Sonatype security research team discovered that the root cause of the vulnerability is in all versions of log4j:log4j, not just in the 1.2.x branch as the advisory states. Detection --------------------------------------------------- The application is vulnerable by using this component under the following circumstances: - The configuration file specifies an allowed third-party `JNDI` lookup host for the `JMSAppender` - the `javax.jms.*` API is included in the application's `CLASSPATH` Reference: https://bugzilla.redhat.com/show_bug.cgi?id=2031667#c28 Recommendation --------------------------------------------------- The 1.x.x component has reach `End of Life`, and users should upgrade to a non-vulnerable version of `org.apache.logging.log4j:log4j-core` as this component includes other security vulnerabilities that are not fixed. References: - https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126 - https://logging.apache.org/log4j/1.2/

Sign in and get help with:

  • Vulnerability details for your components
  • Affected components
  • Affected versions