{"id":11345,"date":"2021-12-11T02:47:37","date_gmt":"2021-12-11T07:47:37","guid":{"rendered":"http:\/\/local.brightwhiz\/?p=11345"},"modified":"2021-12-11T02:47:39","modified_gmt":"2021-12-11T07:47:39","slug":"apache-log4j-utility-zero-day-exploit","status":"publish","type":"post","link":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/","title":{"rendered":"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Made Public"},"content":{"rendered":"\n<p>A critical Apache Log4j utility zero-day exploit (<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-44228\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-44228<\/a>) was made public on December 9, 2021. This vulnerability results in remote code execution (RCE).<\/p>\n\n\n\n<p>Log4j is a powerful <a href=\"http:\/\/local.brightwhiz\/tag\/java\">Java<\/a>-based logging library maintained by the <a href=\"http:\/\/local.brightwhiz\/tag\/apache\">Apache<\/a> Software Foundation.<\/p>\n\n\n\n<p>With this announcement, there is a patch to this vulnerability that is actively being exploited in the wild and therefore all organizations using Log4j should update to version 2.15.0 as soon as possible. The latest version of the Apache Log4j utility can be found on the <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/download.html\" target=\"_blank\" rel=\"noreferrer noopener\">Log4j download page<\/a>.<\/p>\n\n\n\n<p>If updating to the latest version is not immediately possible then customers can also mitigate exploit attempts by setting the system property &#8220;log4j2.formatMsgNoLookups&#8221; to \u201ctrue\u201d; or by removing the JndiLookup class from the classpath.<\/p>\n\n\n\n<p>In all Log4j versions >= 2.0-beta9 and &lt;= 2.14.1 JNDI features used in the configuration, log messages, and parameters can be exploited by an attacker to perform remote code execution. More specifically, an attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.<\/p>\n\n\n\n<p>As of log4j 2.15.0, this behavior has been disabled by default.<\/p>\n\n\n\n<p>More details on the Apache Log4j utility zero-day vulnerability can be found on <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-44228\" target=\"_blank\" rel=\"noreferrer noopener\">the official Log4j security page<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A critical Apache Log4j utility zero-day exploit (CVE-2021-44228) was made public on December 9, 2021. This vulnerability results in remote code execution (RCE). Log4j is a powerful Java-based logging library&#8230;<\/p>\n","protected":false},"author":1,"featured_media":11347,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,16,18],"tags":[58,313,320,327,350,424,433,449,526,591,635],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Revealed<\/title>\n<meta name=\"description\" content=\"Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) that is actively being exploited announced; updating to version 2.15.0 is recommended\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Revealed\" \/>\n<meta property=\"og:description\" content=\"Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) that is actively being exploited announced; updating to version 2.15.0 is recommended\" \/>\n<meta property=\"og:url\" content=\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/\" \/>\n<meta property=\"og:site_name\" content=\"Brightwhiz.com\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/brightwhiz\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-11T07:47:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-12-11T07:47:39+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"680\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Michael Bright\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@brightwhizmag\" \/>\n<meta name=\"twitter:site\" content=\"@brightwhizmag\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Michael Bright\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#article\",\"isPartOf\":{\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/\"},\"author\":{\"name\":\"Michael Bright\",\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/person\/81f0f3126f13834ae2e7f381b3028e32\"},\"headline\":\"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Made Public\",\"datePublished\":\"2021-12-11T07:47:37+00:00\",\"dateModified\":\"2021-12-11T07:47:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/\"},\"wordCount\":222,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\/\/local.brightwhiz\/#organization\"},\"image\":{\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg\",\"keywords\":[\"Apache\",\"InfoSec\",\"Internet\",\"Java\",\"Libraries\",\"Open Source\",\"Optimization\",\"Performance\",\"Security\",\"Tools\",\"Web\"],\"articleSection\":[\"News\",\"Technology\",\"Tools\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/\",\"url\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/\",\"name\":\"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Revealed\",\"isPartOf\":{\"@id\":\"http:\/\/local.brightwhiz\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#primaryimage\"},\"image\":{\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg\",\"datePublished\":\"2021-12-11T07:47:37+00:00\",\"dateModified\":\"2021-12-11T07:47:39+00:00\",\"description\":\"Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) that is actively being exploited announced; updating to version 2.15.0 is recommended\",\"breadcrumb\":{\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#primaryimage\",\"url\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg\",\"contentUrl\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg\",\"width\":1280,\"height\":680,\"caption\":\"Apache Log4j Utility Zero-day Exploit\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\/\/local.brightwhiz\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Made Public\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/local.brightwhiz\/#website\",\"url\":\"http:\/\/local.brightwhiz\/\",\"name\":\"Brightwhiz.com\",\"description\":\"Best Tech guides, Tutorials, and News\",\"publisher\":{\"@id\":\"http:\/\/local.brightwhiz\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/local.brightwhiz\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"http:\/\/local.brightwhiz\/#organization\",\"name\":\"Brightwhiz\",\"url\":\"http:\/\/local.brightwhiz\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/logo\/image\/\",\"url\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/11\/brightwhiz-com-logo-orange.png\",\"contentUrl\":\"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/11\/brightwhiz-com-logo-orange.png\",\"width\":706,\"height\":135,\"caption\":\"Brightwhiz\"},\"image\":{\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/brightwhiz\/\",\"https:\/\/x.com\/brightwhizmag\",\"https:\/\/instagram.com\/bright_whiz\/\",\"https:\/\/www.pinterest.com\/sobbayi\/\",\"https:\/\/www.youtube.com\/channel\/UC6sCdP_d_RiTIM7ErFT-PSQ\"]},{\"@type\":\"Person\",\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/person\/81f0f3126f13834ae2e7f381b3028e32\",\"name\":\"Michael Bright\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\/\/local.brightwhiz\/#\/schema\/person\/image\/\",\"url\":\"http:\/\/1.gravatar.com\/avatar\/da90485875ff0aafa38fdd494abe87d1?s=96&d=mm&r=g\",\"contentUrl\":\"http:\/\/1.gravatar.com\/avatar\/da90485875ff0aafa38fdd494abe87d1?s=96&d=mm&r=g\",\"caption\":\"Michael Bright\"},\"sameAs\":[\"https:\/\/sobbayi.com\"],\"url\":\"http:\/\/local.brightwhiz\/author\/sobbayiadmin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Revealed","description":"Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) that is actively being exploited announced; updating to version 2.15.0 is recommended","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/","og_locale":"en_US","og_type":"article","og_title":"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Revealed","og_description":"Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) that is actively being exploited announced; updating to version 2.15.0 is recommended","og_url":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/","og_site_name":"Brightwhiz.com","article_publisher":"https:\/\/www.facebook.com\/brightwhiz\/","article_published_time":"2021-12-11T07:47:37+00:00","article_modified_time":"2021-12-11T07:47:39+00:00","og_image":[{"width":1280,"height":680,"url":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg","type":"image\/jpeg"}],"author":"Michael Bright","twitter_card":"summary_large_image","twitter_creator":"@brightwhizmag","twitter_site":"@brightwhizmag","twitter_misc":{"Written by":"Michael Bright","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#article","isPartOf":{"@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/"},"author":{"name":"Michael Bright","@id":"http:\/\/local.brightwhiz\/#\/schema\/person\/81f0f3126f13834ae2e7f381b3028e32"},"headline":"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Made Public","datePublished":"2021-12-11T07:47:37+00:00","dateModified":"2021-12-11T07:47:39+00:00","mainEntityOfPage":{"@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/"},"wordCount":222,"commentCount":0,"publisher":{"@id":"http:\/\/local.brightwhiz\/#organization"},"image":{"@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#primaryimage"},"thumbnailUrl":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg","keywords":["Apache","InfoSec","Internet","Java","Libraries","Open Source","Optimization","Performance","Security","Tools","Web"],"articleSection":["News","Technology","Tools"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#respond"]}]},{"@type":"WebPage","@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/","url":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/","name":"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Revealed","isPartOf":{"@id":"http:\/\/local.brightwhiz\/#website"},"primaryImageOfPage":{"@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#primaryimage"},"image":{"@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#primaryimage"},"thumbnailUrl":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg","datePublished":"2021-12-11T07:47:37+00:00","dateModified":"2021-12-11T07:47:39+00:00","description":"Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) that is actively being exploited announced; updating to version 2.15.0 is recommended","breadcrumb":{"@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#primaryimage","url":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg","contentUrl":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/12\/apache-log4j-utility-zero-day-exploit.jpg","width":1280,"height":680,"caption":"Apache Log4j Utility Zero-day Exploit"},{"@type":"BreadcrumbList","@id":"http:\/\/local.brightwhiz\/apache-log4j-utility-zero-day-exploit\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/local.brightwhiz\/"},{"@type":"ListItem","position":2,"name":"Popular Apache Log4j Utility Zero-day Exploit (CVE-2021-44228) Made Public"}]},{"@type":"WebSite","@id":"http:\/\/local.brightwhiz\/#website","url":"http:\/\/local.brightwhiz\/","name":"Brightwhiz.com","description":"Best Tech guides, Tutorials, and News","publisher":{"@id":"http:\/\/local.brightwhiz\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/local.brightwhiz\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"http:\/\/local.brightwhiz\/#organization","name":"Brightwhiz","url":"http:\/\/local.brightwhiz\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/local.brightwhiz\/#\/schema\/logo\/image\/","url":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/11\/brightwhiz-com-logo-orange.png","contentUrl":"http:\/\/local.brightwhiz\/wp-content\/uploads\/2021\/11\/brightwhiz-com-logo-orange.png","width":706,"height":135,"caption":"Brightwhiz"},"image":{"@id":"http:\/\/local.brightwhiz\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/brightwhiz\/","https:\/\/x.com\/brightwhizmag","https:\/\/instagram.com\/bright_whiz\/","https:\/\/www.pinterest.com\/sobbayi\/","https:\/\/www.youtube.com\/channel\/UC6sCdP_d_RiTIM7ErFT-PSQ"]},{"@type":"Person","@id":"http:\/\/local.brightwhiz\/#\/schema\/person\/81f0f3126f13834ae2e7f381b3028e32","name":"Michael Bright","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/local.brightwhiz\/#\/schema\/person\/image\/","url":"http:\/\/1.gravatar.com\/avatar\/da90485875ff0aafa38fdd494abe87d1?s=96&d=mm&r=g","contentUrl":"http:\/\/1.gravatar.com\/avatar\/da90485875ff0aafa38fdd494abe87d1?s=96&d=mm&r=g","caption":"Michael Bright"},"sameAs":["https:\/\/sobbayi.com"],"url":"http:\/\/local.brightwhiz\/author\/sobbayiadmin\/"}]}},"_links":{"self":[{"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/posts\/11345"}],"collection":[{"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/comments?post=11345"}],"version-history":[{"count":0,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/posts\/11345\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/media\/11347"}],"wp:attachment":[{"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/media?parent=11345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/categories?post=11345"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/local.brightwhiz\/wp-json\/wp\/v2\/tags?post=11345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}