Log4Shell, one month on: where it still hides
You patched the obvious Java apps in December. Log4j also hides in vendor products, fat JARs and old containers.
A month after Log4Shell, most teams have patched the Java apps they know about. The problem is the ones they don’t. Last week the US FTC even warned companies it may act against those that leave customer data exposed through this bug.
Log4j is a logging library, so it’s everywhere, often inside other things. Where I still find it:
- Vendor products: VPNs, backup tools, monitoring, VMware, building systems. Check every vendor’s advisory, not just your own code.
- Fat JARs and WAR files where Log4j is bundled inside, invisible to a simple file search.
- Old container images still running, or about to be redeployed.
- Forgotten servers nobody owns: test systems, old intranets, that one Minecraft server.
What to do:
- Upgrade to Log4j 2.17.1 or later (Java 8+).
- Scan with a tool that looks inside archives, such as the free scanners published by CISA and others.
- Block outbound internet access from servers that don’t need it. That breaks the usual attack even on missed systems.
- Check logs since early December for signs of exploitation.
This one will be around for years. The inventory you build now will pay off the next time.