What it is about

Apache log4j ist ein Framework zum Loggen von Anwendungsmeldungen in Java. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um beliebigen Programmcode auszuführen.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• beliebigen Programmcode auszuführen

Am I affected?

Affected according to the BSI:

• Avaya Aura Media Server
• Avaya one-X
• Cisco Video Surveillance Operations Manager
• Cisco Finesse
• Cisco Emergency Responder
• Cisco Unified Contact Center Enterprise
• Debian Linux
• Red Hat OpenShift
• VMware NSX Data Center for vSphere
• Amazon Linux 2
• IBM DB2
• IBM Informix

and 48 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Siemens SIMATIC WinCC V7.4 SP1
• Unify OpenScape UC Application V10.3.10
• Apache log4j 2.16.0
• Red Hat JBoss Enterprise Application Platform 7.3.12
• Red Hat JBoss Enterprise Application Platform 7.1.9

Is the vulnerability already being exploited?

• CVE-2021-44228: exploited in the wild according to CISA, in the catalogue since 10.12.2021, also for ransomware.
• According to a CISA advisory, used by actors from : 2023 Top Routinely Exploited Vulnerabilities (11/2024)
• According to a CISA advisory, used by actors from North Korea: North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs (07/2024)
• According to a CISA advisory, used by actors from China: People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action (07/2024)
• According to a CISA advisory, used by actors from : NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations (10/2023)
• According to a CISA advisory, used by actors from : Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475 (09/2023)
• According to a CISA advisory, used by actors from : Understanding Ransomware Threat Actors: LockBit (06/2023)
• According to a CISA advisory, used by actors from North Korea: #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities (02/2023)
• According to a CISA advisory, used by actors from Iran: Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester (11/2022)
• According to a CISA advisory, used by actors from China: Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors (10/2022)
• According to a CISA advisory, used by actors from Iran: Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations (09/2022)
• According to a CISA advisory, used by actors from : Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems (06/2022)
• According to a CISA advisory, used by actors from : Karakurt Data Extortion Group (06/2022)
• According to a CISA advisory, used by actors from : 2021 Top Routinely Exploited Vulnerabilities (04/2022)
• According to a CISA advisory, used by actors from : Mitigating Log4Shell and Other Log4j-Related Vulnerabilities (12/2021)