Log4Shell - "extremely critical threat" to web servers

Germany's federal cybersecurity watchdog, the BSI, issued a red alert warning, its highest, on a flawed piece of widely-used software, saying it posed an "extremely critical threat" to web servers. The exploit was released for a critical zero-day vulnerability dubbed “Log4Shell” in the Apache Log4j Java logging platform.

 

The critical vulnerability in a widely used software tool, one quickly exploited in the online game Minecraft, hugely popular with kids and owned by Microsoft, is rapidly emerging as a major threat to organizations around the world. The vulnerability affects a number of online services, from Steam and Twitter to Amazon and Minecraft, among others.

 

This vulnerability allows attackers to remotely execute a command on a vulnerable server simply by finding or replacing the user agent of their browser with a special string. The vulnerability, which was unearthed in an open-source logging tool, is present in cloud servers and enterprise software used by numerous industries and governments. The software is used in thousands of corporate applications and websites.

 

There are concerns that it will lead to widespread attacks and deployment of malware. Soon after, Apache released Log4j 2.15.0 to fix the vulnerability, but malicious actors had already started to find and exploit vulnerable servers to exfiltrate data, install malware, or take control of the server.

 

“The vulnerability in a Java-based library known as Log4j can be exploited to allow a complete takeover of the affected system and could allow hackers unfettered access to computer systems. The vulnerability is also easily exploitable, and a proof-of-concept is publicly available," the BSI said.

 

Hackers around the world have been quick to jump on the exploit. Global cybersecurity watchdogs like CERT report that the zero-day is being exploited, with hackers actively on the lookout for servers that haven't upgraded to Apache log4j version 2.15.0. Log4Shell”, is risking several organisations around the world. As it is already installed on millions of servers, anyone with the exploit can get full access to an unpatched computer, which uses the software.

 

The flaw may be the worst computer vulnerability discovered in years. Unless it is fixed, it grants criminals, spies and programming novices alike easy access to internal networks where they can loot valuable data, plant malware, erase crucial information and much more. Located in an open-source Apache software, which is used to run websites and other web services, the vulnerability was reported to the foundation on November 24 by the Chinese tech giant Alibaba. In two weeks, a fix was developed and released.

 

Finally, the real complicated task is the patching of systems around the world.