漏洞描述 Apache Log4j2 是一个基于 Java 的日志记录工具。该工具重写了 Log4j 框架,并且引入了大量丰富的特性。该日志框架被大量用于业务系统开发,用来记录日志信息。 在大多数情况下,开发者可能会将用户输入导致的错误信息写入日志中。攻击者利用此特性可通过该漏洞构造特殊的数据请求包,最终触发远程代码执行。由于该漏洞影响范围极广,建议广大用户及时排查相关漏洞,经过白帽汇安全研究院分析确认,目前市面有多款流行的系统都受影响。 该漏洞危害等级:严重 影响范围Apache Log4j 2.x < 2.15.0-rc2 已知影响组件- Apache Struts2
- Apache Solr
- Apache Flink
- Apache Druid
- flume
- dubbo
- logstash
- VMware Horizon
- VMware vCenter Server
- VMware HCX
- VMware NSX-T Data Center
- VMware Unified Access Gateway
- VMware WorkspaceOne Access
- VMware Identity Manager`
- VMware vRealize Operations
- VMware vRealize Operations Cloud Proxy
- VMware vRealize Log Insight
- VMware vRealize Automation
- VMware vRealize Lifecycle Manager
- VMware Telco Cloud Automation
- VMware Site Recovery Manager
- VMware Carbon Black Cloud Workload Appliance
- VMware Carbon Black EDR Server
- VMware Tanzu GemFire
- VMware Tanzu Greenplum
- VMware Tanzu Operations Manager
- VMware Tanzu Application Service for VMs
- VMware Tanzu Kubernetes Grid Integrated Edition
- VMware Tanzu Observability by Wavefront Nozzle
- Healthwatch for Tanzu Application Service
- Spring Cloud Services for VMware Tanzu
- Spring Cloud Gateway for VMware Tanzu
- Spring Cloud Gateway for Kubernetes
- API Portal for VMware Tanzu
- Single Sign-On for VMware Tanzu Application Service
- App Metrics
- VMware vCenter Cloud Gateway
- VMware Tanzu SQL with MySQL for VMs
- VMware vRealize Orchestrator
- VMware Cloud Foundation
- VMware Workspace ONE Access Connector
- VMware Horizon DaaS
- VMware Horizon Cloud Connector
; ]: F! k1 m% ? { 受影响开源组件项目 仓库地址 版本 - x; z! P; f! a" D0 b
elasticsearch(org.elasticsearch)https://github.com/elastic/elasticsearch8.0.0-alpha2 等(共 100 个)
# o" C& |: A9 g& V% \8 M( ospring-webflux(org.springframework)https://github.com/spring-projects/spring-framework5.2.6.RELEASE 等(共 40 个). @( e; s1 @5 f: Q
druid(com.alibaba)https://github.com/alibaba/druid1.2.8 等(共 68 个)
* G# ?/ @9 s( Bhystrix-rx-netty-metrics-stream(com.netflix.hystrix)https://github.com/Netflix/Hystrix1.5.4 等(共 2 个)
& T2 E* f" s7 G& f' g0 Nspring-cloud-starter-alibaba-sentinel(com.alibaba.cloud)https://github.com/alibaba/spring-cloud-alibaba2021.1 等(共 14 个)
: Z7 O' m) I( u+ c5 d4 I" uspring-boot-starter-ahas-sentinel-client(com.alibaba.csp)https://github.com/alibaba/Sentinel1.3.2 等(共 17 个). I2 {$ X) O" N& Z) `
redisson(org.redisson)https://github.com/redisson/redisson2.2.24 等(共 3 个)
& v% b' t( V; j" E+ KHikariCP(com.zaxxer)https://github.com/brettwooldridge/HikariCP5.0.0 等(共 27 个)
6 y2 ~6 t$ [+ v+ szipkin-collector-service(io.zipkin)https://github.com/openzipkin/zipkin1.40.2 等(共 27 个)
: L' m0 x0 V/ T/ j& `6 a! mmybatis-plus(com.baomidou)https://github.com/baomidou/mybatis-plus3.4.3.4 等(共 41 个)( _1 }: G; Z' P# U/ e9 j
zuul-sample(com.netflix.zuul)https://github.com/Netflix/zuul2.3.0 等(共 10 个), a! W! _- r! I4 f% y/ j" J' ^$ _: d
watson-data-api-client(com.ibm.watson.data)https://github.com/OpenAPITools/openapi-generator0.1 等(共 1 个)) U; J9 P3 I) @9 G1 c
spring-boot-admin-sample-consul(de.codecentric)https://github.com/codecentric/spring-boot-admin2.5.4 等(共 40 个) Y9 i" g; z/ J1 T
jedis(redis.clients)https://github.com/redis/jedisjedis-3.6.2 等(共 36 个)# D1 `$ F5 r7 [5 |2 H8 I, l
grpc-benchmarks(io.grpc)https://github.com/grpc/grpc-java1.9.1 等(共 65 个)# P& w" ~) g! }" f9 R; I
ktor-client-json-tests(io.ktor)https://github.com/ktorio/ktor1.6.7 等(共 32 个)
* O" V+ I2 ~ o5 d+ t: E! f9 |gitbucket_2.13(io.github.gitbucket)https://github.com/gitbucket/gitbucket4.32.0 等(共 27 个)
5 \: s# T) \8 E; j. X' Ifinagle-zipkin_2.12(com.twitter)https://github.com/twitter/finagle7.1.0 等(共 56 个)
$ K/ I# _. j& _, i' Y3 p; W% Dresilience4j-vertx(io.github.resilience4j)https://github.com/resilience4j/resilience4j0.9.0 等(共 9 个)
' V' Z) {* s% Z! D+ f' O* v* velasticsearch-sql(org.nlpcn)https://github.com/NLPchina/elasticsearch-sql6.8.13.0 等(共 9 个)- g! c+ s& H" L
exposed-spring-boot-starter(org.jetbrains.exposed)https://github.com/JetBrains/Exposed0.36.2 等(共 11 个)
7 f ^& q" c1 ublade-sql2o(com.bladejava)https://github.com/lets-blade/blade1.2.9 等(共 1 个): x! `/ w. Q: k" k- O* v- d
netty-socketio(com.corundumstudio.socketio)https://github.com/mrniko/netty-socketio1.7.19 等(共 8 个)# N5 W) C9 D4 k
springfox-swagger2(io.springfox)https://github.com/springfox/springfox2.10.5 等(共 6 个)3 S. b4 I9 \6 D2 q& ~/ d
main_2.12(org.scala-sbt)https://github.com/sbt/sbt1.6.0-RC1 等(共 88 个)) J( B1 f$ Y! \
lettuce-core(io.lettuce)https://github.com/lettuce-io/lettuce-core6.1.5.RELEASE 等(共 42 个) h- r3 ?3 k* Z& i* g; ^& h& D
repository-azure(org.opensearch.plugin)https://github.com/opensearch-project/OpenSearch1.2.0 等(共 3 个)6 W& Y+ S1 N+ ^6 @
reactor-test(io.projectreactor)https://github.com/reactor/reactor-core3.3.4.RELEASE 等(共 3 个)6 L3 j$ O( G8 `7 P# D+ X6 d% t
corda-webserver-impl(net.corda)https://github.com/corda/cordacorda-3.0 等(共 32 个)
* h- q* ]' X M+ E' @! H+ X3 B2 ?conductor-redis-persistence(com.netflix.conductor)https://github.com/Netflix/conductor3.3.6 等(共 100 个)* [9 ~5 {1 [7 F/ M5 d/ D% R3 ]
armeria(com.linecorp.armeria)https://github.com/line/armeria0.26.1.Final 等(共 2 个)" u6 Q/ }6 v7 ^
breeze-parent_2.13(org.scalanlp)https://github.com/scalanlp/breeze2.0.1-RC1 等(共 5 个)
4 R% d+ o1 @& E( z- N; }micrometer-core(io.micrometer)https://github.com/micrometer-metrics/micrometer1.8.1 等(共 98 个)$ ~. L/ D D2 H8 w* X) D; B: o
alink_connector_jdbc_sqlite_flink-1.9_2.11(com.alibaba.alink)https://github.com/alibaba/Alink1.5.1 等(共 3 个)
5 _ U1 i7 i: M- |$ i( Yinitializr-actuator(io.spring.initializr)https://github.com/spring-io/initializr0.9.0 等(共 6 个)) y ?+ x4 g% N ^8 s! ~) O
telegrambots-spring-boot-starter(org.telegram)https://github.com/rubenlagus/TelegramBots4.9.1 等(共 17 个)! F( z; G" Z! Z: i0 c& _& f6 \
spring-data-elasticsearch(org.springframework.data)https://github.com/spring-projects/spring-data-elasticsearch4.3.0 等(共 86 个); C" E; F5 V3 A: }% |) t
feast-common(dev.feast)https://github.com/feast-dev/feast0.9.2 等(共 26 个)/ a- ]3 j2 I6 ]; N! h1 \4 M
javamelody-core(net.bull.javamelody)https://github.com/javamelody/javamelody1.88.0 等(共 13 个)
9 y, I( I! r$ j; lanalytics-zoo-bigdl_0.13.0-spark_3.0.0(com.intel.analytics.zoo)https://github.com/intel-analytics/analytics-zoo0.11.0-RC1 等(共 4 个)
. J( M& Y* v/ X9 n4 Fscio-tensorflow_2.13(com.spotify)https://github.com/spotify/scio0.9.6 等(共 97 个)! {1 Y; m& Z; l9 t# [
grpc-client-spring-boot-autoconfigure(net.devh)https://github.com/yidongnan/grpc-spring-boot-starter2.9.0.RELEASE 等(共 16 个)
/ Z5 e) @, f( [4 O$ H$ z Rinject-server_2.12(com.twitter)https://github.com/twitter/finatra21.9.0 等(共 56 个)9 v; S6 L. j" E( c3 L( l$ S
client-java-examples(io.kubernetes)https://github.com/kubernetes-client/java8.0.2 等(共 1 个)1 ^0 y* j: \8 T- C5 h! V
reactivesocket-tck-drivers(io.reactivesocket)https://github.com/rsocket/rsocket-java0.6.0 等(共 1 个). c' b H. F* x# Z2 ]/ F2 ^9 ^
jest-droid(io.searchbox)https://github.com/searchbox-io/Jest6.3.1 等(共 8 个)
# t5 C2 N8 G" U# Z K4 bgraphql-dgs-example-java-webflux(com.netflix.graphql.dgs)https://github.com/Netflix/dgs-framework4.9.7 等(共 36 个)7 U' |" l: b2 i) A
quill-jdbc-monix_2.11(io.getquill)https://github.com/getquill/quill3.9.0 等(共 62 个)
7 T/ Y1 t9 Z" adoobie-quill_2.12(org.tpolecat)https://github.com/tpolecat/doobie1.0.0-RC1 等(共 61 个)1 u) @/ J8 h ?# }5 g7 {& d7 W8 G
http4k(org.http4k)https://github.com/http4k/http4k4.3.4.1 等(共 3 个)
. H8 M) e( I7 _7 K: M8 oelasticsearch-hadoop(org.elasticsearch)https://github.com/elastic/elasticsearch-hadoop8.0.0-beta1 等(共 100 个)
8 N. s% r6 q( E/ P, rsbt-shading(io.get-coursier)https://github.com/coursier/coursier1.0.0-RC8 等(共 1 个)
# D- X$ b" E( E2 v- P5 c- x2 m# bspark-cassandra-connector-unshaded_2.10(com.datastax.spark)https://github.com/datastax/spark-cassandra-connector2.0.9 等(共 54 个)2 v3 B+ [9 G) r3 a( G
webdrivermanager(io.github.bonigarcia)https://github.com/bonigarcia/webdrivermanager4.0.0 等(共 15 个)
& Y' Z) N" e" h7 scommon-auth-v3(com.tencent.bk.devops.ci.common)https://github.com/Tencent/bk-ci1.2.0-rc.7-RELEASE 等(共 3 个)
+ E( p Q& }1 D! b5 oreactor-netty(io.projectreactor.netty)https://github.com/reactor/reactor-netty1.0.9 等(共 75 个)
& u' B2 ^2 U! I! W% ]% |evcache-client-sample(com.netflix.evcache)https://github.com/Netflix/EVCache5.18.9 等(共 63 个)
% b. h- O" V6 a( J( txtdb-test(com.xtdb)https://github.com/xtdb/xtdb1.20.0 等(共 9 个)
) l$ B: h+ A/ A9 ftransport-netty4(com.strapdata.elasticsearch.plugin)https://github.com/strapdata/elassandra6.2.3.31 等(共 14 个)
1 C: C0 t9 f1 S( isbt-metals(org.scalameta)https://github.com/scalameta/metals0.9.9 等(共 17 个). \- Y ^5 J ^ A
elastic4s-embedded_2.12(com.sksamuel.elastic4s)https://github.com/sksamuel/elastic4s6.7.8 等(共 100 个)
" I$ S6 Q; O1 _genie-agent(com.netflix.genie)https://github.com/Netflix/genie4.0.4 等(共 100 个)
1 M' x7 x5 m1 i1 Rspring-kafka(org.springframework.kafka)https://github.com/spring-projects/spring-kafka2.7.9 等(共 79 个)6 J7 @3 d, A9 p; n2 e
db-async-common_2.13(com.dripower)https://github.com/mauricio/postgresql-async0.3.109 等(共 19 个)5 N( H9 R1 {4 p$ Z, ? ]
selenide(com.codeborne)https://github.com/selenide/selenide5.25.0-selenium-4.0.0-rc-2 等(共 18 个)& o: t: ^% s6 u9 ^
cloudfoundry-identity-server(org.cloudfoundry.identity)https://github.com/cloudfoundry/uaa4.30.0 等(共 1 个)
- a' x/ A& @- G" Q0 }servo-atlas(com.netflix.servo)https://github.com/Netflix/servo0.13.2 等(共 20 个)3 f" {5 T) @' f' ^! |' H* ]: x6 o0 a
rxnetty-spectator-tcp(io.reactivex)https://github.com/ReactiveX/RxNetty0.5.3-rc.4 等(共 12 个)0 S0 E/ s: _8 I6 }
mleap-tensorflow_2.10(ml.combust.mleap)https://github.com/combust/mleap0.9.6 等(共 25 个)! O3 b% N3 g4 N7 g6 C9 i
spark-testing-base_2.12(com.holdenkarau)https://github.com/holdenk/spark-testing-base2.4.4_1.1.1 等(共 100 个). _8 x2 ?- J L# H8 t0 e
graphql-kotlin-spring-client(com.expediagroup)https://github.com/ExpediaGroup/graphql-kotlin5.0.0-alpha.0 等(共 20 个)
. Z% \8 C% s& K5 U o# N4 O& @graphql-spring-boot-test-autoconfigure(com.graphql-java-kickstart)https://github.com/graphql-java-kickstart/graphql-spring-boot8.1.1 等(共 33 个)
% I8 |6 X# g0 I! ?7 u3 t1 M% cdiscord4j-rest(com.discord4j)https://github.com/Discord4J/Discord4J3.2.1 等(共 15 个): u8 M, G$ Q; g7 |1 T& I" s
twitter-server-logback-classic_2.13(com.twitter)https://github.com/twitter/twitter-server21.9.0 等(共 54 个)
0 w) @9 @8 b' U Z8 C8 Usynthea(org.mitre.synthea)https://github.com/synthetichealth/synthea2.7.0 等(共 2 个). D0 r7 p+ e1 q9 W6 U5 ]
spring-integration-redis(org.springframework.integration)https://github.com/spring-projects/spring-integration5.5.6 等(共 30 个). p, w- b' |3 y$ N+ w9 ~
cyclops-reactor-integration(com.oath.cyclops)https://github.com/aol/cyclops10.4.0 等(共 1 个): U# |+ P9 ]* l7 k- d% C
akka-stream-alpakka-geode_2.12(com.lightbend.akka)https://github.com/akka/alpakka1.0-M1 等(共 13 个)6 K3 V v! R# n" s* l! m
mantis-client(io.mantisrx)https://github.com/Netflix/mantis1.3.9 等(共 83 个)& B7 s% H: Y) `% [
mybatis-generator-plugin(com.itfsw)https://github.com/itfsw/mybatis-generator-plugin1.2.9 等(共 31 个): Y1 G m5 o' T5 ^% ?& `1 I6 {/ { b a
ktorm-support-sqlserver(org.ktorm)https://github.com/kotlin-orm/ktorm3.3.0 等(共 11 个)
6 E0 B( @0 ~" a6 Zgatk(org.broadinstitute)https://github.com/broadinstitute/gatk4.beta.2 等(共 39 个)' B5 @4 g5 O0 J2 ]9 V
azure-messaging-servicebus(com.azure)https://github.com/Azure/azure-sdk-for-java7.5.1 等(共 100 个)
+ w: _2 L9 ?" S2 l0 Rmica-metrics(net.dreamlu)https://github.com/lets-mica/mica2.5.7 等(共 7 个)
& H8 v6 G* k+ B ]7 k; Fshiro-redis(org.crazycake)https://github.com/alexxiyang/shiro-redis3.3.1 等(共 2 个)- v3 |/ q. C. a c% Y6 ^
enumeratum-play_2.12(com.beachape)https://github.com/lloydmeta/enumeratum1.5.16 等(共 2 个)
; X8 p9 p. r6 g" C5 S- |jdonframework(org.jdon)https://github.com/banq/jdonframework6.6.8 等(共 1 个)
: d @) X: M* R" C. {8 r" p3 Nweid-java-sdk(com.webank)https://github.com/WeBankBlockchain/WeIdentity1.8.1 等(共 3 个)
3 D" M' p9 G2 clog-protocol(io.shulie.pradar)https://github.com/shulieTech/Takin2.0.3 等(共 3 个); R X4 s- F7 a1 [& {1 u6 _
micro-boot(com.oath.microservices)https://github.com/aol/micro-server1.2.6 等(共 38 个)) q7 w; n( B1 }" p! D
sparkling-water-package_2.11(ai.h2o)https://github.com/h2oai/sparkling-water2.4.10 等(共 36 个)' f0 _8 z k: x- i" d) l7 T
scalatest_2.13(au.com.dius.pact.provider)https://github.com/pact-foundation/pact-jvm4.2.4 等(共 5 个)& C0 D5 S' T, O" }9 C6 _
mssql-jdbc(com.microsoft.sqlserver)https://github.com/microsoft/mssql-jdbc8.3.0.jre11-preview 等(共 100 个)
; A# p2 F" b1 j. Z9 b, Y0 R7 C1 U1 welide-spring-boot-starter(com.yahoo.elide)https://github.com/yahoo/elide6.0.3 等(共 45 个)
! |5 O/ z3 F) p1 Q r" ?# g! Skafka-connect-elastic5(com.datamountaineer)https://github.com/lensesio/stream-reactor1.2.0 等(共 5 个)
& F6 Y% s5 k5 Z# |0 I/ _kvision-server-spring-boot-jvm(io.kvision)https://github.com/rjaros/kvision5.4.3 等(共 9 个)* l8 Q; J$ j& h3 G3 |) y& L* y
r2dbc-postgresql(org.postgresql)https://github.com/pgjdbc/r2dbc-postgresql0.9.0.RC1 等(共 8 个)
' r; z' J: Y4 }2 H& y4 R( J0 g( X* Xplay-slick-evolutions_2.13(com.typesafe.play)https://github.com/playframework/play-slick5.0.0-RC3 等(共 29 个)
. o) M8 j4 R Xsbt-bloop-core(ch.epfl.scala)https://github.com/scalacenter/bloop1.4.8-43-c2d941d9 等(共 29 个)8 w- y* W; @0 A1 ]0 x( d1 n9 Y; c! }
jcseg-elasticsearch(org.lionsoul)https://github.com/lionsoul2014/jcseg2.6.2 等(共 7 个)更多受影响组件查询,请点击以下链接查询:https://log4j2.huoxian.cn/ 漏洞排查代码排查:查看 pom.xml 是否引入 org.apache.logging.log4j、org.apache.logging.log4j2 Linux: sudo find / -name "*log4j-*.jar"Windows: *log4j*.jar攻击排查日志排查: 攻击者在利用前通常采用dnslog方式进行扫描、探测,对于常见利用方式可通过应用系统报错日志中的 "javax.naming.CommunicationException" "javax.naming.NamingException: problem generating object using object factory" "Error looking up JNDI resource"关键字进行排查。 流量排查: 攻击者的数据包中可能存在:“${jndi:rmi”、“${jndi:ldap”字样,可根据此类关键字进行排查。 漏洞复现Vulfocus 靶场环境目前 Vulfocus 已经集成 Log4j2 环境,可通过以下链接启动环境测试: http://vulfocus.fofa.so/#/dashboard?image_id=3b8f15eb-7bd9-49b2-a69e-541f89c4216c 也可通过 docker pull vulfocus/log4j2-rce-2021-12-09:latest 拉取本地环境运行,本地启动命令:docker run -d -P vulfocus/log4j2-rce-2021-12-09:latest 修复建议1、禁止使用 log4j 服务器外连,升级 idk 11.0.1 8u191 7u201 6u211 或更高版本。 2、升级至 log4j-2.15.0-rc2: 下载地址:https://github.com/apache/logging-log4j2/releases/tag/log4j-2.15.0-rc2 3、紧急缓解措施: (1) 修改 jvm 参数 -Dlog4j2.formatMsgNoLookups=true (2) 修改配置 log4j2.formatMsgNoLookups=True (3) 将系统环境变量 FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS 设置 为 true 参考[1] https://github.com/apache/logging-log4j2/releases/tag/log4j-2.15.0-rc1 [2] [LOG4J2-3201] Limit the protocols jNDI can use and restrict LDAP. - ASF JIRA (apache.org) [3] ASF Git Repos - logging-log4j2.git/blob - log4j-core/src/test/java/org/apache/logging/log4j/core/lookup/JndiRestrictedLookupTest.java [4] https://mp.weixin.qq.com/s/wC7mrK1Y4DYz9_yW4fLzbw [5] https://help.aliyun.com/noticelist/articleid/1060971232.html [6] https://mp.weixin.qq.com/s/C4zeXHKHDqPeRuLytO7Fzw 6 A$ a% u9 M" T- j
via https://nosec.org/home/detail/4917.html ; r6 z7 x$ f x
|