Sanitizing Cloudflare Logs to protect customers from the Log4j vulnerability
Dec 14, 2021Jon Levine, Sohei Okamoto
Summary
Introduced a new Logpush job option (`CVE-2021-44228=true`) to automatically redact the `${` token (replacing it with `x{`) in logs sent to customers. This mitigation is specifically designed to protect customers whose log consumption software uses Log4j and is vulnerable to CVE-2021-44228, preventing exploit attempts via log data. The redaction is necessary due to the expressiveness of Log4j's templating language and the observed obfuscated variants of the exploit pattern.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack