Log4Shell Vulnerability

Log4Shell is a severely critical vulnerability that has been disclosed in December 2021 that affects the widely popular Log4j, which is an open source software developed by the Apache Group. It is estimated that roughly a third of the world’s web servers run Log4j.

Log4Shell and it’s derivatives allow remote code execution (RCE) to a great extent. The attackers are typically expected to scan the internet for vulnerable servers since the rate of affection is severe and thus, the potential to discover a vulnerable server is great.

The relative ease of full takeover of the affected systems and the sheer vastness of the amount of affected servers on the open internet makes Log4Shell one of the worst and most impactful vulnerabilities of all time.

Solution

There are four known variants of Log4Shell:

• CVE-2021-44228 (The original Log4Shell)
• CVE-2021-45046
• CVE-2021-45105
• CVE-2021-44832

The only real and recommended solution for all variants are to update Log4j to at least the required minimum patched versions. See below table for version info per variant and update your servers accordingly.

Log4j Update Table

Temporary Mitigations

While there are no real solutions other than updating the affected systems, some temporary precautions and mitigations can be performed.

• Disable the Log4j library. Disabling or shutting down all applications that utilize Log4j is a solution, but this might not be desirable as it is possible that this mitigation will halt your production while also stopping the attackers from reaching your systems.
• Disable JNDI Lookup feature. This operation might possibly require application development and hinder the operations if there are any processes dependent on this feature.
• Isolate the affected systems in their own respective networks by disabling or limiting incoming and outgoing internet traffic. It is imperative that your affected systems do not reach open internet in order to prevent Log4Shell exploitation.
• Utilize a WAF (Web Application Firewall). While effective, this is not a complete solution as WAF devices are prone to be bypassed by more skilled attackers.

LEGAL

Copyright (c) 2019 – 2026 ONLAYER Bilişim Teknolojileri A.Ş.

Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.