Sky-Knight
Well-Known Member
- Reaction score
- 5,513
- Location
- Arizona
NVD - CVE-2021-44228
nvd.nist.gov
How critical? Well, all you have to do is send a POST request against an impacted system and it'll happily run whatever you tell it to.
Critical RCE Vulnerability: log4j - CVE-2021-44228 | Huntress
Our team is currently investigating CVE-2021-44228, a critical vulnerability that’s affecting a Java logging package.
www.huntress.com
ConnectWise and N-Able have been confirmed vulnerable. Heck, Minecraft instances are vulnerable, note this is both server AND client. Though the latter is difficult to exploit unless you're sitting at the machine in question. https://help.minecraft.net/hc/en-us...urity-Vulnerability-in-Minecraft-Java-Edition
Untangle seems to be safe, as of yet because the only instance of log4j we've found on the platform is actually too old to be used in this exploit. That and you need root access to the platform to run the payload at present. But if you're using Untangle please double check your https admin access rules and close that crap to untrusted IP addresses just in case. (Note, you should be doing this already!)
It's bad enough that Cloudflare is considering giving even free customers projection against this mess if you're using their WAF.
Here have a Twitter feed full of people testing this against all sorts of crap, smart devices, everything you can imagine. Java is everywhere of course.
Ladies and Gentlemen... START YOUR PATCHING!
A general mitigation can be done on Windows by this:
If you're using a Unifi Controller on a Windows platform somewhere... this is a good idea to get that environment variable out. I'm currently testing use of this variable on all platforms.
