How Does the Log4Shell Vulnerability Work?
On a fundamental level, the vulnerability is caused by improper input validation. This happens when software doesn’t properly validate the data it receives, leading to possible vulnerabilities, since incorrectly validated input can be used to make the program perform actions it’s not supposed to. Log4Shell specifically takes advantage of requests Log4j sends to servers, utilizing LDAP and JNDI. By taking advantage of these requests, an attacker can execute code on any vulnerable system, which can lead to a malicious actor taking complete control of the system and having the ability to install ransomware or steal data.
What Does Log4Shell Affect?
Since Java is an extremely popular programming language, a lot of software written in Java that uses Log4j for its logging functionality is affected by this vulnerability. Some of the most well-known and commonly-used software affected by this vulnerability include Apache and the video game called Minecraft.
How to Know Which Software Are Affected?
Log4Shell, like any other cybersecurity vulnerability, is mitigated by patching the software affected by it. However, the case of Log4Shell is a bit more unique, since it affects such a wide range of software, and it can be difficult to keep a list of what is affected and what isn’t. Luckily, the National Cyber Security Center of The Netherlands has published a comprehensive list on GitHub, which includes names of software developed by different organizations, that informs whether they are vulnerable to Log4Shell.
How to Scan Your Apache Server for the Vulnerability
Since this vulnerability has greatly affected the cybersecurity and software communities, it is no surprise that there are tools available for administrators to scan their servers for the vulnerability. One such scanner is Log4j-RCE-Scanner, which allows you to scan for remote command execution vulnerability on Apache Log4j at multiple addresses.
Installing Log4j-RCE-Scanner
Before we start, we need to install its dependencies, httpx and curl. Curl can be easily installed on Ubuntu and Debian-based systems using the apt command: The same can be done on Arch Linux using the pacman command: And on CentOS and Fedora installations using the yum command: Installing httpx can be done with the following commands: After installing all of the necessary dependencies, clone the Log4J-RCE-Scanner repository: Access the newly created directory: Finally, add the necessary executable permissions for the Bash script:
Using Log4j-RCE-Scanner
After you have installed the scanner, you can finally get to the fun part of actually using it. Read the script’s help section by typing: Now, you can scan your Apache server for the Log4shell vulnerability. You can specify your domain and Burp Collaborator using the -d and -b flags. If your domain is vulnerable, DNS callbacks with the vulnerable domain name are sent to the Burp Collaborator. Alternatively, the -l flag can also be used to specify a list of domains.
Installing and Using a Python-Based Scanner
If you prefer to use a Python script instead, you can use the log4-scanner, which is developed by the Cybersecurity and Infrastructure Security Agency of the United States. To install it: Access the directory: You can install the required dependencies using the Python-based pip3 command: You can view the “help” provided by the script using the -h flag: Scanning a single URL is simple and can be done using the -u flag: You can also scan a list of URLs by using the -l flag:
How to Patch Apache
To combat this vulnerability, it is extremely important to keep your Apache configuration up to date. Checking the version of Apache can be done in many ways: by checking from your administration panel, such as CPanel, or WebHost Manager. You can also check the version by running the httpd command with the -v flag: Apache can be updated to the latest, most secure version using the apt command on Debian and Ubuntu systems: The same result is also accomplished using the yum command on CentOS:
1. Which versions of Log4j are affected by the vulnerability?
Versions below 2.1.7.1 are vulnerable to the exploit. Version 2.15.0 fixed the most easily exploitable elements, with 2.17.1 fixing a difficult-to-exploit remote code execution vulnerability.
2. Do I need the Burp Collaborator utility to receive DNS callbacks with vulnerable domain names?
According to the developer of the Bash-based scanner, Burp Collaborator is used alongside the script itself to receive the DNS callbacks with vulnerable domain names. Alternatively, an Interact.sh address can be used.
3. Do I need other dependencies to use the Bash-based scanner?
For basic usage, you only need to have httpx and Curl installed on your system as dependencies. However, for unlocking some functionality, you will also need Subfinder, Assetfinder, and Amass to be installed.
