Batoi Research Group 
Introduction
An inaccessible code execution vulnerability was detected a few days ago in the Java logging framework Log4j, named “Log4j” or “Log4j Shell”, officially disclosed as CVE-2021-44228.
Log4j is a universally employed software logging library for Java software. On 9 December 2021, information was publicly announced as the critical security vulnerability in the library by Apache Foundation.
Log4j is fundamentally used for Java Projects; therefore, it is globally accounted that some projects that include vulnerable log4j libraries are also vulnerable. Hackers are actively exploiting such projects as hypersensitivity fast to be detected and prevented.
This white paper will discuss the most-talked vulnerability in the current technological landscape and the steps to mitigate the risk.
About Log4j and How It Is Used
An authentic procedure for debugging software incorporates log statements inserted into the code during the software development lifecycle. Log4j, which is both reliable and feasible, is among such logging libraries for Java.
It is developed and maintained by Apache Software, an open-source foundation; Log4j can operate on Windows, Linux, and Apple’s macOS.
In order to probe the state of the system during runtime, logging is an essential approach in software development. Availability of system activity logs can be helpful to monitor the system at any stage/phase of development. Therefore, developers employ Log4j across different phases of development alongside online gaming, cloud-based data centers, and enterprise software.
Collectively Log4j has three major components-loggers, appenders, and layouts. All work combined to make logging in a systematic manner effective.
Understanding Log4j Vulnerability
The Log4j vulnerability allows threat actors to have a strong hold across web-facing servers by introducing malicious text strings. It exists inside the Log4j, a library for logging errors and events in Java-based applications.
Log4j serves as a third-party logging solution for software professionals to log data inside an application without fabricating any customized solution.
Put simply, hackers can steal confidential information or take advantage of available resources. This vulnerability can reveal organizations to new heaps of cybersecurity risks where attackers can exploit remotely.
Moreover, attackers can control log messages and log message parameters and manipulate different versions of Log4j to commend arbitrary codes and attain complete control of the targeted servers.
It has been hugely reported that hackers are taking advantage of this vulnerability to deploy crypto miners and other potential worms, viruses, and spyware. This vulnerability provides hackers a path to install ransomware inside the system. Ransomware is a type of computer virus sealing up data and systems until victims pay them to unlock the system.
What Types of Systems Are at Risk?
Around the globe, all the Java-based companies and servers hugely deploy the Log4j library. Due to global utilization across applications and digital services, many products are vulnerable to exploitation.
Additionally, it may harm any device running over Apache Log4j version 2.0 to 2.14.1 via accessing the internet. To name a few, Apple’s iCloud, Microsoft’s Minecraft, LinkedIn, Twitter, Amazon, Google, etc, use Apache Log4j.
Being recognized as the zero-day vulnerability, Log4j is subjected to many backlashes. If a program is not provided with a latch, it encourages attackers to crash the system, steal sensitive information, and contaminate networks with malicious software/activities.
How Can Companies Fix the Issue?
-
Identifying internet-facing systems having Log4j embedded and making certain that security teams respond to risk alerts related to these systems.
-
Introducing web applications such as firewall, instructed for automatic update so that team can work on fewer alerts and supporting security vulnerabilities.
-
Following systematic approaches to mitigate the risk of exploitation and ensuring that software application providers thoroughly implement up-to-date versions of Java Programming Language, including patches. Patches allow companies to restrict irrelevant outbound internet traffic- a simple way to prevent vulnerable systems.
Key Takeaways
As the Log4j allowed remote code execution, it allows hackers to compromise a system entirely along with;
- The Log4j library is hugely employed by many software for logging events, making various organizations vulnerable.
- Since logging is used in different applications and circumstances, attacks are invited in various ways.
- It is most easier to attack; a simple string/thread in a request or a message is required to be logged to introduce attacks. And, it works every time, even without the user's consent to click on the link or misconfigure/interrupt the entire system.
