Inside the Log4j2 vulnerability (CVE-2021-44228)
Dec 10, 2021John Graham-Cumming
Summary
This post details the Log4j2 vulnerability (CVE-2021-44228), a critical Remote Code Execution (RCE) flaw in the Java logging package. It explains the vulnerability's history, how it was introduced via the JNDI Lookup plugin, and how attackers can exploit it by controlling LDAP URLs logged by applications. Cloudflare's immediate response involved rolling out WAF rules to block `jndi` lookups in common HTTP request locations to protect customers. The post also provides mitigation steps, including upgrading Log4j or removing the JndiLookup class.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack