Notes

Log4Shell The Most Dangerous Java Vulnerability for Years

On Dec. 9 2021, a zero day exploit (since it was dubbed "Log4Shell") was observed in the wild, targeting a critical RCE vulnerability in Log4j, the widely used open source logging tool. According to NIST the affected versions of Log4j contain JNDI features in log messages, configuration and parameters that do not defend against LDAP controlled by attackers and other JNDI connected endpoints. Numerous platforms have been affected-including Apple, Cloudflare, and Twitter, in addition to the myriad of popular Java ecosystem products with Log4j integrated into their software supply chains including Logstash, Apache Kafka, Elasticsearch and even Minecraft.



The Log4j vulnerability is being seen as the most serious vulnerability in the last few years. It could even be more serious than CVE-2017-5638 vulnerability in Apache Struts RCE that led to the massive breach of Equifax. The latest vulnerability according to Bugcrowd's founder and CTO Casey Ellis is a toxic mix that includes a large attack surface and easy exploitability, as well as a hard-to-elude dependency , and extreme virality. It's a reminder that software supply chains are becoming extremely complex, with interdependencies that are often beyond the capabilities of automated tools like scanners.



As the dust settles, it will be a turning moment for organizations who haven't yet taken a continuous, platform-powered security testing method that blends data, technology and human insight and the force multiplier of the Crowd to detect and correct vulnerabilities before they cause harm. Mpservers We'll discuss how this method helped Bugcrowd validate, contextualize and communicate Log4Shell vulnerabilities to customers in a forthcoming blog.



In the meantime, we're ready to help by offering:



1. For continuous crowd-powered, continuous detection of Log4Shell exposures at your perimeter There is a 30-day "Log4j on Fire" bug bounty solution. Find out more details and get started here. 2. This Security Flash video features Casey Ellis and Adam Foster, Application Security Engineers. It provides more insight into this vuln's risk profile and the potential impact in the future. 3. The week following, Casey will host a live Q&A session at 10 o'clock PST. She will be able to answer all your questions regarding the Log4j vulnerability and Log4Shell exploit. Register now to reserve your spot. 4. Here's a single view of all of our Log4j/Log4Shell resources.



We are very proud of our customers, researchers and team-members who are working together tirelessly to make our connected world safer in this time of uncertainty. As always, we'll make it through it together!


Website: https://mpservers.net/