Since the news of this critical RCE (CVE-2021-44228) in Apache log4j was made public on Friday, Simplify Security\u2019s MTR team has been investigating activity to improve detection and response capabilities.<\/p>\n
As a quick summary, this vulnerability results from how log4j handles processing log messages when sent a specially crafted message by an attacker. This can result in loading an external code class and subsequently the execution of this code which leads to the remote code execution.<\/p>\n
Over the weekend mass Internet scanning has been observed trying to enumerate and exploit this RCE in the wild. As with any newly discovered remote code execution vulnerability, much of the initial observed activity has been for reconnaissance or the deployment of coin miners and\/or botnet payloads.<\/p>\n
Given the ease of exploitability and extent of impacted systems, it is possible this vulnerability will be adopted by threat actors with more nefarious objectives in the future.<\/p>\n
\/\/ What you should do<\/strong><\/p>\n For organisations who are aware of applications and services in your environment which are running log4j:<\/p>\n For organisations that are unsure if they have systems and applications running the log4j library, the following mitigations should be evaluated based on risk tolerance:<\/p>\n Customers can check for exploit attempts against their applications, both successful and unsuccessful by reviewing web server logs looking for patterns resembling \u2018${jndi:\u2019<\/p>\n We also suggest starting conversations with the software and application vendors used within your estate to ensure they are properly addressing this issue. See Sophos\u2019s Advisory in the references.<\/p>\n \/\/ References<\/strong><\/p>\n Sophos<\/strong><\/p>\n Apache<\/strong><\/p>\n CISA<\/strong><\/p>\n\n
\n
\n
\n
\n
\n
\n
\n
\n
\n