Security for everyone

CVE-2021-44228 Scanner

Detects 'Remote Code Execution (RCE)' vulnerability in Apache Log4j2 affects v. 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1).

SCAN NOW

Short Info

Level

Critical

Type

Single Scan

Can be used by

Asset Owner

Estimated Time

10 sec

Scan only one

Url

Parent Category

CVE-2021-44228 Scanner Detail

Apache Log4j2 is a logging framework that offers many powerful features and a flexible configuration. It is widely used in Java-based applications and provides developers with the ability to log messages at different levels. Specifically, it allows logging to files, console output, network streams, and even databases. The straightforward APIs and the variety of appenders make it one of the most popular logging frameworks in the Java ecosystem.

Recently, a severe vulnerability code CVE-2021-44228 has been discovered in Apache Log4j2 versions ranging from 2.0-beta9 to 2.15.0, which can enable remote attackers to execute arbitrary code on an affected system. The flaw exists in the codebase for the JNDI (Java Naming and Directory Interface) features. This problem is primarily the result of the availability of these features to users without security checks, leading to an exploitation of the vulnerability through the use of user-supplied configuration files and log messages.

If left unaddressed, this vulnerability could lead to an attacker executing arbitrary code on the target system. Attackers can use this code to install malware, steal sensitive data, or use the system as part of a botnet. The security flaw is particularly impactful in environments where the JNDI-Lookup feature is enabled, as this can allow an attacker to execute malicious code by including it in the attribute values of a log message or the parameters of a method call. This can result in complete system compromise if the attack successfully exploits the vulnerability.

Thanks to the Pro features of Securityforeveryone.com, you can easily and quickly learn about vulnerabilities in your digital assets. The platform offers continuous monitoring, alerting, and expert guidance, enabling proactive risk management for your organization. Being proactive in your approach to security is the most effective way to prevent breaches and mitigate risks that may arise.

 

REFERENCES

cyber security services for everyone one. Free security tools, continuous vulnerability scanning and many more.
Try it yourself,
control security posture