Notes

Log4Shell, the Worst Java Vulnerability in the last few Years

A zero-day exploit, also known as "Log4Shell", was discovered in the wild on the 9th of December 2021. It targeted a critical RCE vulnerability within Log4j, an open-source tool for logging. According to NIST, affected versions of Log4j include JNDI features in the configuration, log messages and parameters that do not defend against LDAP controlled by attackers and other JNDI connected endpoints. Numerous platforms appear to have been affected-including Apple, Cloudflare, and Twitter-in addition to the raft of well-known Java ecosystem products that have Log4j embedded in their software supply chains including Logstash, Apache Kafka, Elasticsearch and even Minecraft.



Many experts believe that the Log4j vulnerability to be the most serious in years, perhaps even more serious than the Apache Struts RCE vulnerability (CVE-2017-5638) in 2017 that led to a major breach at Equifax. This new vuln as per Bugcrowd's founder and CTO Casey Ellis is a toxic mix that includes a large attack surface and easy exploitability, as well as a hard-to-elude dependency , and extreme virality. It's a reminder that software supply chains have become extremely complex with inter-dependencies that are usually beyond the reach and reach of automated tools such as scanners.



It could be an opportunity for clarity for those companies that haven't yet taken a platform-powered, continuous security testing approach. This method combines data, technology and human insight to detect and address weaknesses before they cause harm. In a future blog post, we'll describe how that approach has helped Bugcrowd verify, validate, contextualize, and communicate Log4Shell vulnerabilities to customers within hours.
JUST ANOTHER BLOG


In the meantime, we're eager to assist by providing:



1. A 30-day "Log4j On Fire" bug bounty solution for continuous, crowd-powered, and continuous discovery of Log4Shell exposures on your perimeter. Learn more about the details and how to start here. 2. Deeper insights about this vuln's risk profile and the impact it could have on the future in this Security Flash video featuring Casey Ellis and Application Security Engineer Adam Foster. 3. This week, Casey will host a live Q&A session starting at 10 o'clock PST. He will answer all your questions about the Log4j exploit and Log4Shell exploit. Sign up now to reserve your seat. 4. Here's a single view of all of our Log4j/Log4Shell resources.



We are extremely happy for our customers, researchers, and team-members who work tirelessly to make our digitally connected world safer in this crisis. As always, we'll make it through this together!


My Website: https://iqbalir.com/