Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
CVE-2021-45105

5.9MEDIUM

Key Information:

Vendor
Apache
Status
Apache Log4j2
Vendor
CVE Published:
18 December 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 95%

Summary

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Affected Version(s)

Apache Log4j2 log4j-core < 2.17.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Log4j_dos_CVE-2021-45105
Created by cckuailong

log4j2_dos_exploit
Created by iAmSOScArEd

https-github.com-pravin-pp-log4j2-CVE-2021-45105
Created by dileepdkumar

References

https://logging.apache.org/log4j/2.x/security.html
x_refsource_MISC
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
x_refsource_CONFIRM
https://www.kb.cert.org/vuls/id/930724
third-party-advisoryx_refsource_CERT-VN

EPSS Score

95% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Independently discovered by Hideki Okamoto of Akamai Technologies, Guy Lederfein of Trend Micro Research working with Trend Micro’s Zero Day Initiative, and another anonymous vulnerability researcher
.