Back to CVEs & Disclosures
CRITICAL — CVSS 10.0

Apache Log4j2 JNDI Message Lookup Code Execution (Log4Shell)

JNDI lookup injection flaw in Apache Log4j2 allowing unauthenticated remote code execution when user-supplied strings are logged.

Status
Vendor Patched
Reported / Disclosed
2021

Impact

  • Arbitrary remote Java class loading over LDAP/RMI from unauthenticated HTTP headers.
  • Ubiquitous blast radius across enterprise Java applications, logging pipelines, and cloud services.
  • Direct root/service account takeover across millions of internet-facing endpoints.

Timeline

  1. NOVEMBER 24, 2021

    Reported to Apache by Alibaba Cloud Security Team.

  2. DECEMBER 9, 2021

    Public disclosure and proof of concept published; global mass scanning commenced.

  3. DECEMBER 10, 2021

    Apache released Log4j 2.15.0 with disabled message lookups by default.

aura~
Back to CVEs & Disclosures