漏洞描述Apache Log4j2 是一个基于 Java 的日志记录工具。该工具重写了 Log4j 框架，并且引入了大量丰富的特性。该日志框架被大量用于业务系统开发，用来记录日志信息。 在大多数情况下，开发者可能会将用户输入导致的错误信息写入日志中。攻击者利用此特性可通过该漏洞构造特殊的数据请求包，最终触发远程代码执行。由于该漏洞影响范围极广，建议广大用户及时排查相关漏洞，经过白帽汇安全研究院分析确认，目前市面有多款流行的系统都受影响。 该漏洞危害等级：严重 影响范围Apache Log4j 2.x < 2.15.0-rc2 已知影响组件- Apache Struts2
- Apache Solr
- Apache Flink
- Apache Druid
- flume
- dubbo
- logstash
- VMware Horizon
- VMware vCenter Server
- VMware HCX
- VMware NSX-T Data Center
- VMware Unified Access Gateway
- VMware WorkspaceOne Access
- VMware Identity Manager`
- VMware vRealize Operations
- VMware vRealize Operations Cloud Proxy
- VMware vRealize Log Insight
- VMware vRealize Automation
- VMware vRealize Lifecycle Manager
- VMware Telco Cloud Automation
- VMware Site Recovery Manager
- VMware Carbon Black Cloud Workload Appliance
- VMware Carbon Black EDR Server
- VMware Tanzu GemFire
- VMware Tanzu Greenplum
- VMware Tanzu Operations Manager
- VMware Tanzu Application Service for VMs
- VMware Tanzu Kubernetes Grid Integrated Edition
- VMware Tanzu Observability by Wavefront Nozzle
- Healthwatch for Tanzu Application Service
- Spring Cloud Services for VMware Tanzu
- Spring Cloud Gateway for VMware Tanzu
- Spring Cloud Gateway for Kubernetes
- API Portal for VMware Tanzu
- Single Sign-On for VMware Tanzu Application Service
- App Metrics
- VMware vCenter Cloud Gateway
- VMware Tanzu SQL with MySQL for VMs
- VMware vRealize Orchestrator
- VMware Cloud Foundation
- VMware Workspace ONE Access Connector
- VMware Horizon DaaS
- VMware Horizon Cloud Connector
* _/ x6 l7 Z5 E) @
受影响开源组件项目 仓库地址 版本
- V. B/ V3 s8 A! q* C) nelasticsearch(org.elasticsearch)https://github.com/elastic/elasticsearch8.0.0-alpha2 等（共 100 个）+ V: w; P/ r: V7 _7 x% s8 A$ E/ ^* p
spring-webflux(org.springframework)https://github.com/spring-projects/spring-framework5.2.6.RELEASE 等（共 40 个）
1 N( w( i0 e$ p9 h1 C0 Ldruid(com.alibaba)https://github.com/alibaba/druid1.2.8 等（共 68 个）( m# V. j- d& o8 `9 J1 O
hystrix-rx-netty-metrics-stream(com.netflix.hystrix)https://github.com/Netflix/Hystrix1.5.4 等（共 2 个）8 `; @* P, V$ L6 g
spring-cloud-starter-alibaba-sentinel(com.alibaba.cloud)https://github.com/alibaba/spring-cloud-alibaba2021.1 等（共 14 个）# A5 U/ X( T! r+ [/ ^
spring-boot-starter-ahas-sentinel-client(com.alibaba.csp)https://github.com/alibaba/Sentinel1.3.2 等（共 17 个）
( I. H$ w/ s, ~$ ?redisson(org.redisson)https://github.com/redisson/redisson2.2.24 等（共 3 个）
2 T h' u. z) o' C" U1 aHikariCP(com.zaxxer)https://github.com/brettwooldridge/HikariCP5.0.0 等（共 27 个）
2 C+ k$ Z# c) U1 {# w, mzipkin-collector-service(io.zipkin)https://github.com/openzipkin/zipkin1.40.2 等（共 27 个）7 i8 p9 r' R/ e# p
mybatis-plus(com.baomidou)https://github.com/baomidou/mybatis-plus3.4.3.4 等（共 41 个）
4 H9 J+ S3 Q" g8 f1 Czuul-sample(com.netflix.zuul)https://github.com/Netflix/zuul2.3.0 等（共 10 个）
% P/ I& w3 u$ A) l4 Y. c* \+ Qwatson-data-api-client(com.ibm.watson.data)https://github.com/OpenAPITools/openapi-generator0.1 等（共 1 个）
" V, r: d8 g/ \/ `7 B2 E4 x {. \spring-boot-admin-sample-consul(de.codecentric)https://github.com/codecentric/spring-boot-admin2.5.4 等（共 40 个）7 D! y6 W8 l( [, ]( W4 c+ ?
jedis(redis.clients)https://github.com/redis/jedisjedis-3.6.2 等（共 36 个）1 Z+ |0 V+ @: P. s
grpc-benchmarks(io.grpc)https://github.com/grpc/grpc-java1.9.1 等（共 65 个）
% G( B) m& z! `( i* d8 B3 bktor-client-json-tests(io.ktor)https://github.com/ktorio/ktor1.6.7 等（共 32 个）
4 D0 }: _$ h7 d( G% D. egitbucket_2.13(io.github.gitbucket)https://github.com/gitbucket/gitbucket4.32.0 等（共 27 个）
! u; }- v2 Y) i _, a( K: afinagle-zipkin_2.12(com.twitter)https://github.com/twitter/finagle7.1.0 等（共 56 个）; y6 q" d$ P) J
resilience4j-vertx(io.github.resilience4j)https://github.com/resilience4j/resilience4j0.9.0 等（共 9 个）
% }8 D3 ^$ b# r) z' |2 U) Oelasticsearch-sql(org.nlpcn)https://github.com/NLPchina/elasticsearch-sql6.8.13.0 等（共 9 个）
! V/ f0 ^( P" x8 b$ W& kexposed-spring-boot-starter(org.jetbrains.exposed)https://github.com/JetBrains/Exposed0.36.2 等（共 11 个）
6 I; i* N* G% s% V1 t7 M# b5 P* yblade-sql2o(com.bladejava)https://github.com/lets-blade/blade1.2.9 等（共 1 个）
0 r$ c* t# T) _netty-socketio(com.corundumstudio.socketio)https://github.com/mrniko/netty-socketio1.7.19 等（共 8 个）
$ |2 R$ w$ I2 b" G5 ~. X& |# w Ospringfox-swagger2(io.springfox)https://github.com/springfox/springfox2.10.5 等（共 6 个）
: `! { f6 ]8 ?, amain_2.12(org.scala-sbt)https://github.com/sbt/sbt1.6.0-RC1 等（共 88 个）# H) P! j( H0 u) O6 k, f3 s# n
lettuce-core(io.lettuce)https://github.com/lettuce-io/lettuce-core6.1.5.RELEASE 等（共 42 个）7 q z8 V" _8 h. q/ o* `. ?
repository-azure(org.opensearch.plugin)https://github.com/opensearch-project/OpenSearch1.2.0 等（共 3 个）1 D3 g2 b$ I! O! A' x: \$ G7 B
reactor-test(io.projectreactor)https://github.com/reactor/reactor-core3.3.4.RELEASE 等（共 3 个）; t. r# ^, g; t7 |. S1 R' j& `
corda-webserver-impl(net.corda)https://github.com/corda/cordacorda-3.0 等（共 32 个）+ J& B3 b) m2 d1 s/ u( y. y
conductor-redis-persistence(com.netflix.conductor)https://github.com/Netflix/conductor3.3.6 等（共 100 个）
" b# _7 h0 z% Z( U# k. Barmeria(com.linecorp.armeria)https://github.com/line/armeria0.26.1.Final 等（共 2 个）
- b! ^, k# t4 p" F/ H2 I$ ~; Hbreeze-parent_2.13(org.scalanlp)https://github.com/scalanlp/breeze2.0.1-RC1 等（共 5 个）
l3 X h0 \4 [/ L# A1 ?# Wmicrometer-core(io.micrometer)https://github.com/micrometer-metrics/micrometer1.8.1 等（共 98 个）
8 m( N* U+ o; g! P aalink_connector_jdbc_sqlite_flink-1.9_2.11(com.alibaba.alink)https://github.com/alibaba/Alink1.5.1 等（共 3 个）. H" E% I0 l+ v
initializr-actuator(io.spring.initializr)https://github.com/spring-io/initializr0.9.0 等（共 6 个）
; k$ o2 e1 L* E5 T" f7 ntelegrambots-spring-boot-starter(org.telegram)https://github.com/rubenlagus/TelegramBots4.9.1 等（共 17 个）# C# ^" j) b# k. n4 v' T/ d7 R; g
spring-data-elasticsearch(org.springframework.data)https://github.com/spring-projects/spring-data-elasticsearch4.3.0 等（共 86 个）# o+ @! V! \! T
feast-common(dev.feast)https://github.com/feast-dev/feast0.9.2 等（共 26 个）6 B8 `1 K6 M: G" c, c2 ^: u$ H" @
javamelody-core(net.bull.javamelody)https://github.com/javamelody/javamelody1.88.0 等（共 13 个）2 D. W5 s9 \( t4 F/ `* q
analytics-zoo-bigdl_0.13.0-spark_3.0.0(com.intel.analytics.zoo)https://github.com/intel-analytics/analytics-zoo0.11.0-RC1 等（共 4 个）4 j! j4 v, j! j
scio-tensorflow_2.13(com.spotify)https://github.com/spotify/scio0.9.6 等（共 97 个）) g) Y* @. ~$ ?- a: f. H' {, h
grpc-client-spring-boot-autoconfigure(net.devh)https://github.com/yidongnan/grpc-spring-boot-starter2.9.0.RELEASE 等（共 16 个）
; j! s" x, t5 o- kinject-server_2.12(com.twitter)https://github.com/twitter/finatra21.9.0 等（共 56 个）* p/ Q- R, @- d! P3 Y
client-java-examples(io.kubernetes)https://github.com/kubernetes-client/java8.0.2 等（共 1 个）
8 G% M, I( U: s2 \7 X0 [4 u, vreactivesocket-tck-drivers(io.reactivesocket)https://github.com/rsocket/rsocket-java0.6.0 等（共 1 个）' X. u+ m0 O$ z, G. d o
jest-droid(io.searchbox)https://github.com/searchbox-io/Jest6.3.1 等（共 8 个）
4 C" S6 q9 o6 x1 jgraphql-dgs-example-java-webflux(com.netflix.graphql.dgs)https://github.com/Netflix/dgs-framework4.9.7 等（共 36 个）4 a' T, Y% z- u+ Z: ^2 T
quill-jdbc-monix_2.11(io.getquill)https://github.com/getquill/quill3.9.0 等（共 62 个）
2 W& n: {2 l# R& Sdoobie-quill_2.12(org.tpolecat)https://github.com/tpolecat/doobie1.0.0-RC1 等（共 61 个）2 i* {. k( r( e+ J% W' s; C
http4k(org.http4k)https://github.com/http4k/http4k4.3.4.1 等（共 3 个）( n6 X, k4 r0 t& s% f! g
elasticsearch-hadoop(org.elasticsearch)https://github.com/elastic/elasticsearch-hadoop8.0.0-beta1 等（共 100 个）& d3 u: T3 M& z, ~: W
sbt-shading(io.get-coursier)https://github.com/coursier/coursier1.0.0-RC8 等（共 1 个）
4 V8 j: s0 v. G, ^spark-cassandra-connector-unshaded_2.10(com.datastax.spark)https://github.com/datastax/spark-cassandra-connector2.0.9 等（共 54 个）7 [7 n5 T0 [: b- ^0 J+ D" w7 w, {
webdrivermanager(io.github.bonigarcia)https://github.com/bonigarcia/webdrivermanager4.0.0 等（共 15 个）! `2 ]7 \) P3 l5 c
common-auth-v3(com.tencent.bk.devops.ci.common)https://github.com/Tencent/bk-ci1.2.0-rc.7-RELEASE 等（共 3 个）7 B5 D6 j7 i2 n. w+ k, M
reactor-netty(io.projectreactor.netty)https://github.com/reactor/reactor-netty1.0.9 等（共 75 个）; I( O' B( R6 o
evcache-client-sample(com.netflix.evcache)https://github.com/Netflix/EVCache5.18.9 等（共 63 个）* Y! P, g* ^$ z8 [4 A% f; q
xtdb-test(com.xtdb)https://github.com/xtdb/xtdb1.20.0 等（共 9 个）; ^6 f5 q. y- M( j; `0 [3 l
transport-netty4(com.strapdata.elasticsearch.plugin)https://github.com/strapdata/elassandra6.2.3.31 等（共 14 个）8 v2 w9 q% q/ W% q
sbt-metals(org.scalameta)https://github.com/scalameta/metals0.9.9 等（共 17 个）: ^) ^# z6 ^# }
elastic4s-embedded_2.12(com.sksamuel.elastic4s)https://github.com/sksamuel/elastic4s6.7.8 等（共 100 个）
1 ?7 c _" o5 @8 l$ k! `2 y4 z, q" @, |genie-agent(com.netflix.genie)https://github.com/Netflix/genie4.0.4 等（共 100 个）7 p$ n9 A7 S& C6 ]8 }0 d
spring-kafka(org.springframework.kafka)https://github.com/spring-projects/spring-kafka2.7.9 等（共 79 个）7 Z6 f5 K: w6 a6 H& B- H) ~
db-async-common_2.13(com.dripower)https://github.com/mauricio/postgresql-async0.3.109 等（共 19 个）
4 i0 Y% C; f7 v1 k: D; wselenide(com.codeborne)https://github.com/selenide/selenide5.25.0-selenium-4.0.0-rc-2 等（共 18 个）6 W2 F0 }1 c: | y5 Y
cloudfoundry-identity-server(org.cloudfoundry.identity)https://github.com/cloudfoundry/uaa4.30.0 等（共 1 个）
6 d- Z# @3 ^; Z5 T, I6 Sservo-atlas(com.netflix.servo)https://github.com/Netflix/servo0.13.2 等（共 20 个）5 v2 p0 X+ [: M# C9 E' U7 J
rxnetty-spectator-tcp(io.reactivex)https://github.com/ReactiveX/RxNetty0.5.3-rc.4 等（共 12 个）1 G" U, b/ q2 k3 d. I* ~
mleap-tensorflow_2.10(ml.combust.mleap)https://github.com/combust/mleap0.9.6 等（共 25 个） s- w, e5 l6 B5 n2 o9 M
spark-testing-base_2.12(com.holdenkarau)https://github.com/holdenk/spark-testing-base2.4.4_1.1.1 等（共 100 个）6 c/ {& _, h! Y# \4 ^0 o
graphql-kotlin-spring-client(com.expediagroup)https://github.com/ExpediaGroup/graphql-kotlin5.0.0-alpha.0 等（共 20 个）
: D/ z% c4 x4 p# G4 @- q( Jgraphql-spring-boot-test-autoconfigure(com.graphql-java-kickstart)https://github.com/graphql-java-kickstart/graphql-spring-boot8.1.1 等（共 33 个）7 h k2 `% x) X
discord4j-rest(com.discord4j)https://github.com/Discord4J/Discord4J3.2.1 等（共 15 个）
6 u0 e( a5 y/ l6 s# ktwitter-server-logback-classic_2.13(com.twitter)https://github.com/twitter/twitter-server21.9.0 等（共 54 个）
/ _& V0 \+ b0 a% ?* Vsynthea(org.mitre.synthea)https://github.com/synthetichealth/synthea2.7.0 等（共 2 个）
* z6 I6 F9 O$ y ~8 sspring-integration-redis(org.springframework.integration)https://github.com/spring-projects/spring-integration5.5.6 等（共 30 个）0 T' K9 c; q* g/ ?) Y5 Z5 J8 q3 }
cyclops-reactor-integration(com.oath.cyclops)https://github.com/aol/cyclops10.4.0 等（共 1 个）" g' l0 j5 @/ [
akka-stream-alpakka-geode_2.12(com.lightbend.akka)https://github.com/akka/alpakka1.0-M1 等（共 13 个）/ Y Q& Z6 F1 _6 G( ]# p/ A% B4 S
mantis-client(io.mantisrx)https://github.com/Netflix/mantis1.3.9 等（共 83 个） O" m2 x( J8 h2 \# B, \7 P/ p
mybatis-generator-plugin(com.itfsw)https://github.com/itfsw/mybatis-generator-plugin1.2.9 等（共 31 个）
6 D: J6 s5 B! F' h! n% y6 Xktorm-support-sqlserver(org.ktorm)https://github.com/kotlin-orm/ktorm3.3.0 等（共 11 个）
7 P& A3 [2 f' e6 p: k! _gatk(org.broadinstitute)https://github.com/broadinstitute/gatk4.beta.2 等（共 39 个）8 s: }6 [* H5 V% Q9 U# x( x
azure-messaging-servicebus(com.azure)https://github.com/Azure/azure-sdk-for-java7.5.1 等（共 100 个）1 u3 s6 ?& x& I
mica-metrics(net.dreamlu)https://github.com/lets-mica/mica2.5.7 等（共 7 个）
' b( i6 w/ ^0 b! N- S, |4 oshiro-redis(org.crazycake)https://github.com/alexxiyang/shiro-redis3.3.1 等（共 2 个）
. |( h" A. I5 [, I7 k' R; Uenumeratum-play_2.12(com.beachape)https://github.com/lloydmeta/enumeratum1.5.16 等（共 2 个）6 @" y h3 { o: I! K
jdonframework(org.jdon)https://github.com/banq/jdonframework6.6.8 等（共 1 个）
: d2 x4 H& w+ V; m: k" _weid-java-sdk(com.webank)https://github.com/WeBankBlockchain/WeIdentity1.8.1 等（共 3 个）7 C; V% A8 _: N5 p
log-protocol(io.shulie.pradar)https://github.com/shulieTech/Takin2.0.3 等（共 3 个）
2 D! [5 ^! B; P; @micro-boot(com.oath.microservices)https://github.com/aol/micro-server1.2.6 等（共 38 个）
- F3 m7 R9 F: ksparkling-water-package_2.11(ai.h2o)https://github.com/h2oai/sparkling-water2.4.10 等（共 36 个）5 M+ B1 } J. o! n; B
scalatest_2.13(au.com.dius.pact.provider)https://github.com/pact-foundation/pact-jvm4.2.4 等（共 5 个）' f. g6 k. f6 i j9 o
mssql-jdbc(com.microsoft.sqlserver)https://github.com/microsoft/mssql-jdbc8.3.0.jre11-preview 等（共 100 个）
: a3 Z8 s0 |" g+ G5 @: X6 N* \elide-spring-boot-starter(com.yahoo.elide)https://github.com/yahoo/elide6.0.3 等（共 45 个）; q% z q% g; y4 P- L
kafka-connect-elastic5(com.datamountaineer)https://github.com/lensesio/stream-reactor1.2.0 等（共 5 个） E* c8 Z4 N' J0 V7 A3 I- e
kvision-server-spring-boot-jvm(io.kvision)https://github.com/rjaros/kvision5.4.3 等（共 9 个）
3 W, ~- B4 o3 t0 V, or2dbc-postgresql(org.postgresql)https://github.com/pgjdbc/r2dbc-postgresql0.9.0.RC1 等（共 8 个）
! {, n! j4 r; m6 Iplay-slick-evolutions_2.13(com.typesafe.play)https://github.com/playframework/play-slick5.0.0-RC3 等（共 29 个）
! |& z$ t: v% v. l6 ^sbt-bloop-core(ch.epfl.scala)https://github.com/scalacenter/bloop1.4.8-43-c2d941d9 等（共 29 个）+ [0 G; |8 d' r& A) F! y/ ]
jcseg-elasticsearch(org.lionsoul)https://github.com/lionsoul2014/jcseg2.6.2 等（共 7 个）更多受影响组件查询，请点击以下链接查询：https://log4j2.huoxian.cn/ 漏洞排查代码排查：查看 pom.xml 是否引入 org.apache.logging.log4j、org.apache.logging.log4j2 ![]()
Linux： sudo find / -name "*log4j-*.jar"![]()
Windows： *log4j*.jar![]()
攻击排查日志排查： 攻击者在利用前通常采用dnslog方式进行扫描、探测，对于常见利用方式可通过应用系统报错日志中的 "javax.naming.CommunicationException" "javax.naming.NamingException: problem generating object using object factory" "Error looking up JNDI resource"关键字进行排查。 流量排查： 攻击者的数据包中可能存在：“${jndi:rmi”、“${jndi:ldap”字样，可根据此类关键字进行排查。 漏洞复现![]()
Vulfocus 靶场环境目前 Vulfocus 已经集成 Log4j2 环境，可通过以下链接启动环境测试： http://vulfocus.fofa.so/#/dashboard?image_id=3b8f15eb-7bd9-49b2-a69e-541f89c4216c 也可通过 docker pull vulfocus/log4j2-rce-2021-12-09:latest 拉取本地环境运行，本地启动命令：docker run -d -P vulfocus/log4j2-rce-2021-12-09:latest ![]()
修复建议1、禁止使用 log4j 服务器外连，升级 idk 11.0.1 8u191 7u201 6u211 或更高版本。 2、升级至 log4j-2.15.0-rc2： 下载地址：https://github.com/apache/logging-log4j2/releases/tag/log4j-2.15.0-rc2 3、紧急缓解措施： （1） 修改 jvm 参数 -Dlog4j2.formatMsgNoLookups=true （2） 修改配置 log4j2.formatMsgNoLookups=True （3） 将系统环境变量 FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS 设置 为 true 参考[1] https://github.com/apache/logging-log4j2/releases/tag/log4j-2.15.0-rc1 [2] [LOG4J2-3201] Limit the protocols jNDI can use and restrict LDAP. - ASF JIRA (apache.org) [3] ASF Git Repos - logging-log4j2.git/blob - log4j-core/src/test/java/org/apache/logging/log4j/core/lookup/JndiRestrictedLookupTest.java [4] https://mp.weixin.qq.com/s/wC7mrK1Y4DYz9_yW4fLzbw [5] https://help.aliyun.com/noticelist/articleid/1060971232.html [6] https://mp.weixin.qq.com/s/C4zeXHKHDqPeRuLytO7Fzw
! J. v" Z( [3 x9 Y+ b3 Evia https://nosec.org/home/detail/4917.html + Z+ P6 Z. X: q. b$ I5 B$ N
| 
/1 
IP卡
狗仔卡
发表于 2021-12-15 10:10:25
QQ好友和群
QQ空间
腾讯微博
腾讯朋友
收藏
分享
顶
踩
转发到微博
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
抢沙发
千斤顶
显身卡