Log4Shell: what to do this week
A bug in the Log4j logging library lets attackers run code with a single line of text. Find every Java app you have.
On Thursday a critical bug in Log4j 2, a Java logging library used almost everywhere, became public: CVE-2021-44228, Log4Shell. If an app logs a string an attacker controls, such as a username, a search term or a browser header, the attacker can make the server run their code.
Mass scanning started within hours. This one will last.
This week:
- Find every Java application, yours and your vendors’: web apps, VPNs, monitoring, backup, building systems.
- Upgrade Log4j to 2.16.0, released yesterday. 2.15.0 turned out not to be enough.
- Follow vendor advisories for products you can’t patch yourself.
- Block outbound internet access from servers that don’t need it. It stops the common attack even on systems you missed.
- Look at logs for
${jndi:strings and unexpected outbound LDAP connections.
Expect weeks of follow-up advisories. Keep the list you build; you’ll need it again.