Cybersecurity agencies in Australia, Canada, New Zealand, the United States and England released joint guidance on Wednesday in response to the active exploitation of a number of Apache Log4j vulnerabilities.
“These vulnerabilities, especially Log4Shell, are very serious,” the manual says. “Sophisticated cyberthreat actors are actively scanning networks to potentially exploit Log4Shell, CVE-2021-45046 and CVE-2021-45105 on vulnerable systems. These vulnerabilities are likely to be exploited for a long time. "
An attacker could exploit Log4Shell (CVE-2021-44228) by sending a specially crafted request to an affected system that would force that system to execute arbitrary code. CVE-2021-45046, on the other hand, allows remote code execution in non-standard configurations, while CVE-2021-45105 can be used for a DoS attack.
After discovering the appearance of information about vulnerabilities in the public domain, unpatched servers attack everyone and everything: from ransomware distributors to state hackers. Cobalt Strike beacons, cryptominers and botnets were seen in the hacked networks.
The FBI's assessment of the attacks also suggested that attackers are incorporating these vulnerabilities into "existing cybercrime schemes that seek to use increasingly sophisticated obfuscation techniques." Because of the severity of the vulnerabilities and the potential for increased exploitation, organizations are strongly encouraged to identify, clean up and update affected assets as soon as possible.
In this regard, the US Cybersecurity and Infrastructure Protection Agency (CISA) and the CERT Coordination Center have released utilities to identify systems vulnerable to Log4Shell.
The final step so far taken by the Apache Software Foundation (ASF) has released a patch for Apache HTTP Server 2.4.51 that addresses the vulnerabilities CVE-2021-44790 (CVSS score: 9.8) and CVE-2021-44224 (CVSS score: 8.2) - the first of which can be used by a remote attacker to execute arbitrary code and gain control over an infected system.
bbabo.Net