We analyzed the system architecture during the early stages of development and performed end-to-end security testing of the web application. Recently, Harbinger helped an employee benefits product to test, and identify security gaps in their web application. Other projects like Log4net and Log4cxx are not impacted by this. Apache Log4j is the only Logging Services subproject affected by this vulnerability.

Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.

Only the log4j-core JAR file is impacted by this vulnerability.

If an attacker sends a specially crafted message like $ where they originate from sources external to the application such as HTTP headers or user input. The vulnerability results from how log messages are being handled by the log4j processor. The vulnerability ( CVE-2021-44228) is critical, as it can be exploited from remote by an unauthenticated adversary to executed arbitrary code (remote code execution – RCE).Ĭommon Vulnerability Scoring System (CVSS) evaluates vulnerabilities based on their severity score and the criticality of this vulnerability is scored as a 10 (10 out of 10). The library is widely adopted and used in many commercial and open-source software products as a logging framework for Java. Log4j is a popular Java library developed and maintained by the Apache foundation.

When these reports were received, it appeared that the vulnerability had already been exploited by threat actors “in the wild” and that no patch was available to fix the zero-day exploit. Public proof of concept (PoC) code was released, and subsequent investigation revealed that exploitation was incredibly easy to perform. 9, 2021, a remote code execution (RCE) vulnerability in Apache log4j 2 was traced.

Lansweeper log4j report