Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in older versions of Apache Log4j allows an attacker to execute code remotely if they can write to the application's configuration. This is possible when a specific, non-default component called JMSAppender is used, which then makes malicious calls when processing configuration settings. Teams should pay attention because this could lead to a complete compromise of affected systems.
- Can lead to remote code execution.
- Requires specific, non-default configuration.
- Affects older Log4j 1.2 versions.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this by gaining write access to the Log4j configuration file. They would then modify the `JMSAppender` to include malicious JNDI lookups, leading to remote code execution when the application processes logs. This relies on a specific, non-default configuration.
- Attacker needs config write access.
- Targets `JMSAppender` configuration.
- Requires specific, non-default setup.
Live Threat
Current exploitation, exposure, and threat context
Attackers might target this vulnerability due to its potential for remote code execution, similar to the widespread Log4Shell. However, exploitation is less straightforward as it requires a specific, non-default configuration of Log4j 1.2's JMSAppender and the attacker to have write access to the configuration. This significantly limits the attack surface compared to more easily accessible vulnerabilities.
- Requires specific configuration.
- Attacker needs write access.
- Log4j 1.2 is end-of-life.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize identifying and isolating systems using Log4j 1.2 with a JMSAppender configuration. Review logs for signs of exploitation attempts targeting this specific vulnerability, as it allows for remote code execution via deserialization. Due to the potential for high impact, take affected services offline if they are critical and cannot be immediately patched or mitigated.
- Block or rate-limit outbound JNDI lookups.
- Remove or disable the JMSAppender configuration.
- Upgrade to Log4j 2 or a newer, supported logging library.
