Hackers Begin Exploiting Second Log4j Vulnerability as a Third Flaw Emerges

Web infrastructure company Cloudflare on Wednesday revealed that
threat actors are actively attempting to exploit a second bug^[1]
disclosed in the widely used Log4j logging utility, making it
imperative that customers move quickly to install the latest
version as a barrage of attacks continues to pummel unpatched
systems with a variety of malware.

“This vulnerability is actively being exploited and anyone using
Log4J should update to version 2.16.0 as soon as possible, even if
you have previously updated to 2.15.0,” Cloudflare’s Andre Bluehs
and Gabriel Gabor said^[2].

The new vulnerability, assigned the identifier CVE-2021-45046^[3], makes it possible for
adversaries to carry out denial-of-service (DoS) attacks and
follows disclosure from the Apache Software Foundation (ASF) that
the original fix for the remote code execution bug — CVE-2021-44228
aka Log4Shell — was “incomplete in certain non-default
configurations.” The issue has since been addressed in Log4j
version 2.16.0.

Even more troublingly, researchers at security firm Praetorian
warned of a third separate security weakness^[4] in Log4j version 2.15.0
that can “allow for exfiltration of sensitive data in certain
circumstances.” Additional technical details of the flaw have been
withheld to prevent further exploitation, but it’s not immediately
clear if this has been already addressed in version 2.16.0.

The latest development comes as advanced persistent threat
groups from China, Iran, North Korea, and Turkey, counting the
likes of Hafnium^[5]
and Phosphorus^[6], have jumped into the
fray to operationalize the vulnerability and discover and continue
exploiting as many susceptible systems as possible for follow-on
attacks. Over 1.8 million attempts^[7]
to exploit the Log4j vulnerability have been recorded to date.

Microsoft Threat Intelligence Center (MSTIC) said^[8]
it also observed access brokers leveraging the Log4Shell flaw to
gain initial access to target networks that were then sold to other
ransomware affiliates. In addition, dozens of malware families that
run the gamut from cryptocurrency coin miners and remote access
trojans to botnets and web shells have been identified taking
advantage of this shortcoming to date.

While it’s common for threat actors to make efforts to exploit
newly disclosed vulnerabilities before they’re remediated, the
Log4j flaw underscores the risks arising from software supply
chains when a key piece of software is used within a broad range of
products across several vendors and deployed by their customers
around the world.

“This cross-cutting vulnerability, which is vendor-agnostic and
affects both proprietary and open-source software, will leave a
wide swathe of industries exposed to remote exploitation, including
electric power, water, food and beverage, manufacturing,
transportation, and more,” industrial cybersecurity firm Dragos
noted^[9].

“As network defenders close off more simplistic exploit paths
and advanced adversaries incorporate the vulnerability in their
attacks, more sophisticated variations of Log4j exploits will
emerge with a higher likelihood of directly impacting Operational
Technology networks,” the company added.