The Log4j vulnerability likely affects millions of devices. But it (and vulnerabilities like it) can be stopped.

IMPORTANT: For the latest information regarding SonicWall products and Apache Log4j, please see PSIRT Advisory ID SNWLID-2021-0032, which will be continually updated. The SonicWall Product Security and Incident Response Team (PSIRT) is always researching and providing up-to-date information about the latest vulnerabilities. 

Last week’s disclosure of the Apache Log4j (CVE-2021-44228) vulnerability put the internet on fire and set cybersecurity teams scrambling to provide a fix. The issue lies in Log4j, an open-source Apache logging framework that developers have been using for years to keep track of activities within an application. CVE-2021-44228 allows remote attackers, who actively scan the internet for systems affected by the vulnerability, to easily take control of vulnerable systems

What is the Log4j vulnerability?

Log4j is a Java library broadly used in enterprise and web applications. The problem is that the Log4j framework is unrestrained and follows requests without any vetting or verifications. This “implicit trust” approach allows an attacker to conduct a completely unauthenticated remote code execution (RCE) by submitting a specially crafted request to the vulnerable system. An attacker needs to strategically send a malicious code string that eventually gets logged by Log4j version 2.0 or higher to allow them to take control.

To make matters worse, Log4j is not easy to patch in production systems. If something goes wrong, an organization’s logging capability could be compromised precisely when it’s needed most — to watch for attempted exploitation.

Most tech vendors, including Amazon Web Services, Microsoft, Google Cloud, IBM and Cisco, have reported that some of their services were vulnerable. These vendors and others have been quickly working to fix any issues, release software updates where applicable and advise customers on the next steps. SonicWall has also been working to provide necessary patches, investigate the impact and provide necessary updates to customers.

What is the scope of the impact for Log4j?

The discovery of this zero-day vulnerability has created a virtual earthquake because it affects anything that uses Java. Any servers that are exposed to the internet and run Java applications with the affected Log4j library are at risk.

Attempts to exploit this vulnerability are particularly hard to detect because any string that might get logged by Log4j could trigger the vulnerability — it could be anything from user-agent or system-generated strings to email subject lines.

The Microsoft Security Response Center has reported that most Log4Shell activities have been mass scanning and fingerprinting by hackers, probably for future attacks, as well as scanning by security companies and researchers. Other observed activities have included installing coin miners, running Cobalt Strike to enable credential theft and lateral movement, and exfiltrating data from the compromised systems.

How ZTNA adoption minimizes Log4j risk

SonicWall Cloud Edge is built on zero-trust architecture that enables access and network connectivity to internal and external resources. By combining Cloud Edge Zero Trust Network Architecture (ZTNA) and tightly defined policies, admins can ensure servers are not publicly exposed to the internet, but only to users who meet certain criteria and are allowed to pass through network firewall or Stateful FWaaS.

Using ZTNA and SDP architecture to protect and hide all of the underlying services from public access, we can mitigate the Log4Shell vulnerability by only passing activity logs within the internal network. SonicWall Cloud Edge ZTNA by default will not allow them to be sent outside the local network over a public internet connection.

SonicWall Cloud Edge significantly reduces the attack surface and potential damage to the internal network by allowing admins to precisely control and limit any traffic generated from inside or outside the network. By segmenting your cloud, on-prem or hybrid network with ZTNA, you can also contain the spread of malicious code or activity within your defined network perimeter.