• Home
  • Services
    • Managed Detection and Response
    • Security Assessment
    • Phishing Assessment
    • Vulnerability Management
    • CISO as a Service
    • Penetration Testing
    • Outside-in-Security
    • Inside-Out-Security
    • Security Audit
    • Static Code Analysis
  • Insights
  • Contact Us
Menu
  • Home
  • Services
    • Managed Detection and Response
    • Security Assessment
    • Phishing Assessment
    • Vulnerability Management
    • CISO as a Service
    • Penetration Testing
    • Outside-in-Security
    • Inside-Out-Security
    • Security Audit
    • Static Code Analysis
  • Insights
  • Contact Us
Phone-alt Linkedin

Log4j Vulnerability

Log4j continues to disrupt global festive season change freezes.

On Friday (10 December 2021), NIST announced a remote code execution vulnerability (CVE-2021-44228) https://nvd.nist.gov/vuln/detail/CVE-2021-44228 in the Apache log4j project. Log4j is one of the pervasive, open-source building blocks that applications across your infrastructure use for logging.

The vulnerability is of critical severity as it can be exploited to execute arbitrary code within your network and NIST reflect this with a 10/10 under the Common Vulnerability Scoring System v3.

 

The key timelines:

  • Vulnerability identified on 24 November 2021.
  • Critical Vulnerability reported on 26 November.
  • Apache project released v2.15 as first remediation attempt on 6 December.
  • The security researcher announced the vulnerability at 1:25am (AEDT) Friday 10 December.
  • First exploit attempt in our MDR customers at 12:51pm (blocked by web application firewall).
  • NZ CERT announce active exploits being observed @ 9:30pm Friday 10 December.
  • NIST announce a second vulnerability (2021-45406) on Tuesday 14 December.
  • Apache project released v2.16 in response on the same day.

 

Brace168 follows industry recognised detection and response methodology and incident response practice.

To avoid confusion and undue panic, Brace168 has conducted a series of tests and investigations of this CVE, which as a result has presented the following triaged findings:

 

Brace168 SOC Security Analysts have:

  • Assessed the exposure across our internal systems, to which there was not any adverse findings;
  • Any of Brace168 managed customers, which there was not any adverse findings;
  • Provided remediation assistance for the vulnerable systems that were identified in our customer base, and;
  • Implemented rules in our SIEM to identify attempted exploits.

 

To prevent exploitation of this vulnerability we advise our customer to urgently:

  • Assess the vulnerability across their entire infrastructure using an updated vulnerability detection tool such as Tenable or Rapid7 in conjunction with the contextual understanding of systems and environment;
  • Apply one or more of the following actions to contain the vulnerability:
  • Apply the latest patch to log4j;
  • Disable the Java Naming Directory Interface (JNDI) lookup with configuration for systems that can’t be upgraded;
  • Apply web application firewall (WAF) rules for defence in depth, and;
  • Communicate the urgency of this vulnerability to suppliers and partners, to minimise any potential threat to your supply chain.

 

Brace168 continues to monitor this critical vulnerability across our systems and those of our customers, if there are any material changes, we will advise our customer base in a timely manner.

In the meantime, if you have any concerns regarding this highly rated CVE please contact Brace168 SOC or account management if we can help in identification of this exploit and remediation efforts.

Recent blog posts

Common Vulnerabilities and Exposures – October 2022

Read More »

Hacks – October 2022

Read More »

Protecting your data – The CIA Triad – Part One: Confidentiality

Read More »

Need help with this?

Enter your details below and one of our team will get in touch

Other Similar Articles

Brace168 News AusCERT Conference

Read More »

Common Vulnerabilities and Exposures August 2021

Read More »

Partner News – Check Point Harmony Offer

Read More »

The Value of Security Performance Reporting

Read More »
View all our blog articles
Linkedin
  • Insights
  • Contact Us
Menu
  • Insights
  • Contact Us

Our Office

Level 2, 157 Walker Street, North Sydney, NSW 2060

Call Us

(02) 9136 6066

Email Address

info@brace168.com