CVE-2021-45046 Scanner

Apache Log4j is a popular logging utility in the Java-based application development world. It allows developers to customize the logging output in their applications, making it easier to identify and debug issues. This tool is widely used in enterprise-level Java applications and has become an essential component of many software projects.

However, recently, a severe security vulnerability was detected in Apache Log4j, titled CVE-2021-45046. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This vulnerability could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data using a JNDI Lookup pattern, resulting in information leakage and remote code execution in some environments and local code execution in all environments.

When exploited, CVE-2021-45046 could lead to disastrous consequences. Hackers could gain complete control of the victim's system and access sensitive information such as usernames, passwords, and intellectual property. The attacker could also use the compromised system to launch further attacks, causing even more harm. Therefore, it is essential to protect systems against this vulnerability.

Thanks to the pro features of the s4e.io platform, those who read this article can easily and quickly learn about vulnerabilities in their digital assets. The platform offers a host of security tools such as vulnerability scanners, threat intelligence, and penetration testing, making it easier for organizations to detect and prevent cybersecurity threats. With s4e.io, you can stay ahead of the game and keep your systems secure.

REFERENCES

• http://www.openwall.com/lists/oss-security/2021/12/14/4
• http://www.openwall.com/lists/oss-security/2021/12/15/3
• http://www.openwall.com/lists/oss-security/2021/12/18/1
• https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
• https://lists.fedoraproject.org/archives/list/[email protected]/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/
• https://logging.apache.org/log4j/2.x/security.html
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
• https://www.cve.org/CVERecord?id=CVE-2021-44228
• https://www.debian.org/security/2021/dsa-5022
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
• https://www.kb.cert.org/vuls/id/930724
• https://www.oracle.com/security-alerts/alert-cve-2021-44228.html