Hear from CIOs, CTOs, and other C-level and senior execs on data and AI strategies at the Future of Work Summit this January 12, 2022. Learn more
A “vaccine” against the Log4Shell vulnerability appears to offer a way to reduce risk from the widespread flaw affecting servers that run Apache Log4j. The script was developed by researchers at security vendor Cybereason and released for free on Friday evening, following the disclosure of the critical zero-day vulnerability late on Thursday.
The Log4Shell vulnerability affects Apache Log4j, an open source Java logging library deployed broadly in cloud services and enterprise software. The flaw is considered highly dangerous since it can enable remote code execution (RCE) — in which an attacker can remotely access and control devices — and is seen as fairly easy to exploit, as well. Log4Shell is “probably the most significant [vulnerability] in a decade” and may end up being the “most significant ever,” Tenable CEO Amit Yoran said Saturday on Twitter.
According to W3Techs, an estimated 31.5% of all websites run on Apache servers. The list of companies with vulnerable infrastructure reportedly includes Apple, Amazon, Twitter, and Cloudflare. Vendors including Cisco, VMware, and Red Hat have issued advisories about potentially vulnerable products.
“This vulnerability, which is being widely exploited by a growing set of threat actors, presents an urgent challenge to network defenders given its broad use,” said Jen Easterly, director of the federal Cybersecurity and Infrastructure Security Agency (CISA), in a statement posted Saturday.
The vulnerability has impacted version 2.0 through version 2.14.1 of Apache Log4j, and organizations are advised to update to version 2.15.0 as quickly as possible.
Buying some time
But patching can be a time-consuming process. To supplement patching efforts, Cybereason says its tool — which it calls “Logout4Shell” — has the potential to “immunize” vulnerable servers, providing protection against attacker exploits that target the flaw.
While updating to the latest version of Log4j is no doubt the best solution, patching is often complex, requiring a release cycle and testing cycle, said Yonatan Striem-Amit, cofounder and chief technology officer at Cybereason. “A lot of companies find it difficult to go and deploy emergency patches,” he said in an interview with VentureBeat.
The Logout4Shell “vaccine” essentially buys some time for security teams as they work to roll out patches, Striem-Amit said. The fix disables the vulnerability and allows organizations to stay protected while they update their servers, he said.
Cybereason has described the fix as a “vaccine” because it works by leveraging the Log4Shell vulnerability itself. “The fix uses the vulnerability itself to set the flag that turns it off,” Striem-Amit wrote in a blog post. “Because the vulnerability is so easy to exploit and so ubiquitous — it’s one of the very few ways to close it in certain scenarios.”
Additionally, the Cybereason fix is “relatively simple” because only basic Java skills are required to implement it, he wrote.
Potential to help
With the Logout4Shell tool, security teams can “take a server that you suspect is vulnerable, and feed the string into places that you think are potentially vulnerable. If your application is not vulnerable at all, nothing happens,” Striem-Amit told VentureBeat.
“However, if your server is vulnerable to this attack, the exploit will get triggered, which will download the code that we supply,” he said. “And what that source code does is go into the configuration and disable the vulnerable components. So the server continues running, none the wiser — but any future attempt to exploit this vulnerability now won’t do anything. The vulnerable component is now disabled, and you’re done.”
Casey Ellis, founder and chief technology officer at bug bounty platform Bugcrowd, told VentureBeat that the Cybereason fix appears to be effective and has the potential to assist security teams.
Ellis said that due to the complexity of regression testing Log4j, “I’ve already heard from a number of organizations that are pursuing the workarounds contained in the Cybereason tool as their primary approach.”
“It remains to be seen whether many enterprises choose to exploit the vulnerability itself in order to achieve this,” he said. “But I would expect at least some to use the tool selectively and situationally.”
There are some limitations for the Cybereason fix, however.
For one thing, the mitigation does not work prior to version 2.10 of Log4j. The exploit also must “fire properly” in order to be effective, Ellis said. “And even when it does run properly, it still leaves the vulnerable code in place,” he said.
Still, “this strikes me as a very clever ‘option of last resort,’” Ellis said. “Many organizations are currently struggling to inventory where Log4j exists in their environment, and updating a component like this necessitates a dependency analysis in order to avoid breaking a system in the pursuit of fixing a vulnerability.”
All of this “adds up to a lot of work. And having a ‘fire and forget’ tool to clean up anything that may have been missed at the end of it all seems like a scenario that many organizations will find themselves in, in the coming weeks,” he said.
Ultimately, Ellis said he sees the Cybereason fix as a supplementary tool rather than a cure-all.
“It’s a workaround with a number of limitations,” he said. “[But] it has intriguing potential as a tool in the toolbox as organizations reduce Log4j risk. And if it makes sense for them to use it, one of the primary reasons will be speed to risk reduction.”
Striem-Amit told VentureBeat that he’s seen a large amount of positive feedback about Logout4Shell, on Twitter and other websites, but said that Cybereason is not tracking usage of it.
The company — which says that none of its own products are affected by the Log4Shell vulnerability — also plans to develop a version of the Logout4Shell tool that can support earlier versions of Log4j, so that all servers can be protected using this method, he said.
Importantly, no one should see the tool as a “permanent” solution to addressing the Log4Shell vulnerability, according to Striem-Amit.
“The idea isn’t that this is a long-term fix solution,” he said. “The idea is, you buy yourself time to now go and apply the best practices — patch your software, deploy a new version, and all the other things required for good IT hygiene.”
VentureBeat’s mission is to be a digital town square for technical decision-makers to gain knowledge about transformative technology and transact.
Our site delivers essential information on data technologies and strategies to guide you as you lead your organizations. We invite you to become a member of our community, to access:
- up-to-date information on the subjects of interest to you
- our newsletters
- gated thought-leader content and discounted access to our prized events, such as Transform 2021: Learn More
- networking features, and more