Skip to content
This repository has been archived by the owner on Sep 4, 2023. It is now read-only.

Latest commit

 

History

History
52 lines (37 loc) · 2.8 KB

README_en.md

File metadata and controls

52 lines (37 loc) · 2.8 KB
Raw

CVE-2021-44228 Log4j2 JNDI RCE Mitigation

Chinese version

Usage

  1. Locate log4j2-core component under deploy path

    find . -name '*log4j-core*.jar'

  2. Apply mitigation against log4j2-core JARs found above

    • Method 1: Use zip command to remove JndiLookup.class from the JAR (recommended) 
      zip -q -d 'JAR_path_here' org/apache/logging/log4j/core/lookup/JndiLookup.class
    • Method 2: Replace your JAR with patched JAR from this repo (under log4j2-core/ directory)
      All JARs included in this repo comes from maven, with JndiLookup.class removed and no further modification.
      You can replace your JAR safely if the filename matches.

  3. Restart you application for the mitigation to become effective.

How does it work?

To improve compatibility on some JRE that does not provide JNDI, changeset LOG4J2-703 wraps ${jndi:xxx} registration with try/catch. When JndiLookup instansiation failed, there will be only warning log instead of throw an exception. We can effectively stop ${jndi:xxx} handler from registering by removing JndiLookup.class file, thus avoid triggering the vulnerability.

  • This mitigation applies to all stable release of log4j2, while log4j2.formatMsgNoLookups option only applies to log4j2 ≥ 2.10
  • This mitigation does not disable all lookups, the functionality of ${date:xxx}, ${ctx:xxx}, etc are preserved.
  • Sometimes modification to log4j2.xml / log4j2.properties / -classpath are not trivial, or may be overridden on runtime. Modifying JAR is much simpler and effective.

Acknowledge

This mitigation was acknowledged by log4j2 team:

Thank you @zhangyoufu for the suggested workaround for older versions of log4j to remove the JndiLookup.class class! The team likes your idea and we will include the workaround you suggested in the release notes and announcement email. Many thanks!

Reference

Other mitigations