Quantum Secular Labs / Blog / Advisories

CVE-2021-45046: Apache Log4j2 Deserialization of Untrusted Data Vulnerability

CVE-2021-45046 is rated critical with a CVSS v3.1 base score of 9.0 and affects Apache Log4j2, along with 54 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-05-01, which means exploitation in the wild has been observed.

Vulnerability description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, ${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Severity breakdown

CVSS v3.1 9.0: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: High. Success depends on conditions outside the attacker’s control.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Affected products

  • Apache Log4j: from 2.0.1 before 2.12.2; from 2.13.0 before 2.16.0; 2.0; 2.0 beta9; 2.0 rc1; 2.0 rc2
  • Cvat Computer Vision Annotation Tool: all versions listed by NVD
  • Intel Audio Development Kit: all versions listed by NVD
  • Intel Datacenter Manager: all versions listed by NVD
  • Intel Genomics Kernel Library: all versions listed by NVD
  • Intel Oneapi: all versions listed by NVD
  • Intel Secure Device Onboard: all versions listed by NVD
  • Intel Sensor Solution Firmware Development Kit: all versions listed by NVD
  • Intel System Debugger: all versions listed by NVD
  • Intel System Studio: all versions listed by NVD
  • Siemens Sppa T3000 Ses3000 Firmware: all versions listed by NVD
  • Siemens Captial: before 2019.1; 2019.1; 2019.1 sp1912
  • Siemens Comos: all versions listed by NVD
  • Siemens Desigo Cc Advanced Reports: 4.0; 4.1; 4.2; 5.0; 5.1
  • Siemens Desigo Cc Info Center: 5.0; 5.1

References