How to analyze the latest log4j2 remote code execution vulnerabilities

What this article shares to you is about how to analyze the latest log4j2 remote code execution vulnerabilities, the editor thinks it is very practical, so I share it with you to learn. I hope you can get something after reading this article.

Problem description

The Apache Log4j2 remote code execution vulnerability exploited code on the night of December 9. The exploit does not require special configuration, and after multi-party verification, Apache Struts2, Apache Solr, Apache Druid, Apache Flink and so on are affected. Apache Log4j2 is a popular Java log framework. It is recommended that the vast number of exchanges, wallets and DeFi projects check whether they are affected by vulnerabilities and upgrade the new version as soon as possible.

Apache Log4j2 is a Java-based logging tool. This tool rewrites the Log4j framework and introduces a large number of rich features. The logging framework is widely used in business system development to record log information. In most cases, developers may write error messages caused by user input to the log. The vulnerability triggers remote code execution as long as data entered by an external user is logged.

After being studied and judged by the border infinite security attack and defense team, it is concluded that the scope of the vulnerability is very wide, and the vulnerability is extremely harmful.

To affect the way of judgment, users only need to check whether log4j-api and log4j-core are introduced into the Java application. If there is application use, it is very likely to be affected.

Brief introduction of vulnerabilities

Vulnerability name: Apache Log4j2 remote code execution vulnerability

Component name: Apache Log4j2

Impact version: 2.0 ≤ Apache Log4j