Notes

Log4Shell, the Worst Java Vulnerability in the last few Years

A zero-day exploit, now known as "Log4Shell" was discovered in the wild on December 9, 2021. It targeted a crucial RCE vulnerability in Log4j. It is an open-source logging program. According to NIST the affected versions of Log4j contain JNDI features in log messages, configuration and parameters that do not defend against LDAP controlled by attackers and other JNDI connected endpoints. Numerous platforms appear to be affected, including Apple, Cloudflare, and Twitter, as well as the plethora of popular Java ecosystem products with Log4j integrated into their supply chains of software including Logstash, Apache Kafka, Elasticsearch and even Minecraft.



The Log4j vulnerability is being viewed as the most serious vulnerability in years. It may even be more serious than CVE-2017-538 vulnerability in Apache Struts RCE that led to Equifax's massive breach. According to Bugcrowd's Founder and CTO Casey Ellis, this new vulnerability is a poisonous mix with a huge attack surface, easy exploit dependencies that are difficult to avoid, and extreme vulnerability to virality. It's a reminder that software supply chains have become extremely complicated with inter-dependencies that are usually beyond the reach and reach of automated tools, such as scanners.



It will provide an opportunity to gain clarity for organizations that have yet to implement a platform-powered continuous security testing approach. This approach combines data, technology and human insight to detect and fix weaknesses before they cause harm. We'll discuss how this approach helped Bugcrowd validate, contextualize and communicate Log4Shell vulnerabilities to customers in a subsequent blog.
T launcher


We are available to help you with the following:



1. For continuous crowd-powered detection of Log4Shell exposures in your area for a period of 30 days, you can avail the "Log4j on Fire" bug bounty solution. Start by reading the details. 2. More information about the vulnerability profile of this vuln and its potential impact in this Security Flash video featuring Casey Ellis and Application Security Engineer Adam Foster. 3. Next week, Casey will host a live Q&A session at 10 o'clock PST. She will be able to answer all your questions regarding the Log4j exploit and the Log4Shell exploit. Sign up now to reserve your spot. 4. A single view into all our Log4j/Log4Shell resource here.



We are very happy for our customers and researchers who have worked tirelessly to make our digitally connected world more secure in this time of crisis. We'll get it done, just like we always do!


Homepage: https://t-launcher.net/