CISA, FBI and NSA Publish Joint Advisory and Scanner for Log4j Vulnerabilities

Cybersecurity agencies from Australia, Canada, New Zealand, the
U.S., and the U.K. on Wednesday released a joint advisory in
response to widespread exploitation of multiple vulnerabilities in
Apache’s Log4j software library by nefarious adversaries.

“These vulnerabilities, especially Log4Shell, are severe,” the
intelligence agencies said in the new^[1]
guidance^[2]. “Sophisticated cyber
threat actors are actively scanning networks to potentially exploit
Log4Shell^[3], CVE-2021-45046^[4], and CVE-2021-45105^[5]
in vulnerable systems. These vulnerabilities are likely to be
exploited over an extended period.”

An attacker can exploit Log4Shell (CVE-2021-44228) by submitting
a specially crafted request to a vulnerable system that causes that
system to execute arbitrary code. CVE-2021-45046, on the other
hand, allows for remote code execution in certain non-default
configurations, while CVE-2021-45105 could be leveraged by a remote
attacker to cause a denial-of-service (DoS) condition.

Since the vulnerabilities became public knowledge this month,
unpatched servers have come under siege^[6]
from ransomware groups to nation-state hackers, who have used the
attack vector as a conduit to gain access to networks to deploy
Cobalt Strike beacons, cryptominers, and botnet malware.

The U.S. Federal Bureau of Investigation’s (FBI) assessment of
the attacks has also raised the possibility that threat actors are
incorporating the flaws into “existing cyber criminal schemes that
are looking to adopt increasingly sophisticated obfuscation
techniques.” In light of the severity of the vulnerabilities and
likely increased exploitation, organizations are being urged to
identify, mitigate, and update affected assets as soon as
possible.

To that end, the U.S. Cybersecurity and Infrastructure Security
Agency (CISA) has also released^[7] a scanner utility to
identify systems vulnerable to the Log4Shell vulnerability,
mirroring a similar tool^[8]
released by the CERT Coordination Center (CERT/CC).

The latest step taken by the governments arrives as the Apache
Software Foundation (ASF) released^[9]
updates for Apache HTTP Server 2.4.51 to address two flaws —
CVE-2021-44790^[10] (CVSS score: 9.8) and
CVE-2021-44224^[11] (CVSS score: 8.2) — the
former of which could be weaponized by a remote attacker to execute
arbitrary code and take control of an affected system.