A Year Later, That Brutal Log4j Vulnerability Is Still Lurking
A year ago, as Russia amassed troops at its border with Ukraine and the Covid-19 Omicron variant began to surge around the world, the Apache Software Foundation disclosed a vulnerability that set off a frenzy across the global tech industry. The bug, known as Log4Shell, was in the ubiquitous open-source logging library Log4j and exposed a wide range of applications and services—from popular consumer and enterprise platforms to critical infrastructure and internet-of-things devices. Now, after weeks of intensive remediation last December and a year of cumulative progress on patching, Log4Shell no longer poses the universal threat it once did. But researchers warn that the vulnerability is still present in far too many systems worldwide, and that attackers will be successfully exploiting it for years.
Many critical vulnerabilities get discovered every year that are of high urgency to address, but Log4Shell was unusual because it was so easy to exploit wherever it was present, with few caveats or subtleties for attackers to navigate. Developers use logging utilities to record operations in a given application. All attackers need to do to exploit Log4Shell is get the system to log a special string of code. From there, they can take control of their target to install malware or mount other digital attacks. Loggers gonna log, so introducing the malicious snippet can be as easy as including it in an account username or sending it in an email.
Continued here