How Cloudflare security responded to Log4j 2 vulnerability
Dec 11, 2021Rushil Shah, Thomas Calderon
Summary
This post details Cloudflare's internal response to the Log4j2 vulnerability (CVE-2021-44228). It outlines the process of identifying vulnerable systems (ElasticSearch, LogStash, Bitbucket), applying mitigation strategies (removing JndiLookup class, setting system property), and reviewing external reports. It also describes the internal investigation using asset inventory, code scanning, log analysis, network analytics, and endpoint analysis to confirm no compromise. The post highlights the effectiveness of defense-in-depth strategies like restricting outbound traffic and using Cloudflare Access for internal services.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack