Log4j Vulnerability Detection Available in Greenbone Feeds
Update from 2021-12-20: information about additional vulnerabilities found for Log4j can be found here.
Update from 2021-12-15: the most important FAQ about the Log4j vulnerability detection with Greenbone can be found here.
A critical vulnerability (Log4Shell, CVE-2021-44228) in the widely used Java library Log4j has been discovered. Greenbone has integrated local security checks and active checks via HTTP in their feeds which will help users with the Log4j vulnerability detection to find out if and which of their systems may be affected. Additionally, a special scan configuration which checks precisely for this vulnerability is available for quick results via the feeds.
The vulnerability leads to an extremely critical threat situation, according to the Federal Office for Information Security (BSI). For this reason, the BSI has released a warning of the highest level on the issue. The vulnerability is trivially exploitable, and may allow a complete takeover of the affected systems.
It is a critical risk since attackers can insert code snippets via various ways into the log4j module (e.g., via a regular chat message) and then load code for execution from any LDAP server (which may be under your control).
Customers running Log4j are highly recommend to update their solutions to Log4j version 2.15.0 (or later) to mitigate this flaw, but should be aware of the following:
- The update currently is “only” restricting access to external LDAP servers by default (will only allow localhost/127.0.0.1) and sets the default of the system property
log4j2.formatMsgNoLookupstotrue. - While this mitigates the risk, there may still be applications running Log4j version 2.15.0 that have both (or one) of the above settings incorrect or misconfigured so that the attack vector still exists.
Regarding our solution, customers should be also aware of the following:
- For a successful detection of this risk, the scanner host needs to be reachable by the target host via TCP.
- There may be also a flaw in a software which is only gathering and logging the syslog from other remote systems for example, but does not accept logs itself. Such systems could still be attacked by log pollution.
- It is very important to monitor updates of affected products.
- In addition, all systems that were vulnerable should be examined for compromise.
Elmar Geese has many years of experience in IT and IT security. He has been a member of the Greenbone management team since 2018 and a member of the Greenbone AG Executive Board since 2023.
He is particularly interested in the topics of management, security and the management of security, so-called artificial and human intelligence, especially in the context of cybersecurity.
As a trained musician, he still enjoys playing various instruments and is a great fan of classical music.
