Notes

Log4Shell: The Worst Java Vulnerability for Years

A zero-day vulnerability, now known as "Log4Shell", was discovered in the wild on the 9th of December 2021. It targeted a critical RCE vulnerability in Log4j, an open-source logging program. (Per NIST in affected versions, JNDI features used in configuration log messages, configuration parameters do not provide protection against LDAP that is controlled by an attacker and other JNDI-related endpoints.) Numerous platforms appear to be affected, including Apple, Cloudflare, and Twitter, as well as the plethora of well-known Java ecosystem products that have Log4j integrated into their supply chains of software, such as Logstash, Apache Kafka, Elasticsearch, and even Minecraft.



Many experts think the Log4j vulnerability to be the most severe in recent years, possibly more dangerous than the Apache Struts RCE vulnerability (CVE-2017-5638) in 2017 that led to a huge breach at Equifax. As Bugcrowd's CTO and Founder Casey Ellis, this new vuln is a toxic cocktail with a huge attack surface, simple exploitation dependencies that are difficult to avoid, and extreme the degree of virality. It's a reminder of the way supply chains for software have become extremely complex with inter-dependencies that are often beyond the reach and reach of automated tools such as scanners.



It could be a moment of clarity for organizations that have yet taken a platform-powered, continuous security testing method. This method combines data, technology and human insight to detect and fix security vulnerabilities before they cause harm. We'll discuss how this method helped Bugcrowd confirm the context of its findings and communicate Log4Shell vulnerabilities to customers in a subsequent blog.



We are available to help you with the following issues:



1. A 30 day "Log4j On Fire" bug bounty solution for continuous, crowd-powered, and continuous discovery of Log4Shell exposures on your perimeter. Nici's Blog Get started and read the full details. 2. This Security Flash video features Casey Ellis and Adam Foster, Application Security Engineers. It provides more insight into the risk profile of this vuln as well as future impact. 3. This week, Casey will host a live Q&A session starting at 10 o'clock PST. He will answer your questions about the Log4j exploit and the Log4Shell exploit. Sign up now to reserve your seat. 4. Here's one view of all our Log4j/Log4Shell resource.



We are super proud of our customers, researchers and team-members who work together tirelessly to make our connected world safer in this time of crisis. As always, we'll get through it together!


My Website: https://nicisoft.com/