One line of text in a log could give attackers full control of a server. Why Log4Shell still matters and how to make sure you are protected.
Publicly disclosed: 10 December 2021
Log4j is a popular Java library for writing logs, used inside thousands of products — from web applications and VPN appliances to games and industrial software. In December 2021 it became known that a specially crafted text string, written to a log, made Log4j load and run code from the attacker's server. Mass scanning started within hours.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2021-44228 | Critical, CVSS 10.0 | Log4j 2.0-beta9 – 2.14.1 | 2.15.0; later fixes: 2.16.0, 2.17.1 |
The attack needed no login: it was enough that any user-controlled text — a username, a browser User-Agent, a chat message — reached the log. Many companies did not even know Log4j was inside the products they used.
log4j-core JAR files, including those packed inside other archives.You cannot patch what you do not know you have.
Sources: Apache Log4j security, NVD CVE-2021-44228, CISA guidance.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.