Log4j Zero-Day RCE Flaw CVE-2021-44228: Cloudflare Deploys WAF Rules
A zero-day remote code execution (RCE) vulnerability in the widely used Apache Log4j library was disclosed on December 9, 2021, and is already being actively exploited. Tracked as CVE-2021-44228, the flaw affects Log4j versions 2.0-beta9 through 2.14.1.
Anyone relying on Log4j should update to version 2.15.0 immediately. If an upgrade isn't feasible, administrators can mitigate the issue by removing the JndiLookup class from the classpath. For Log4j versions 2.10 and later, setting either the log4j2.formatMsgNoLookups system property or the LOG4J_FORMAT_MSG_NO_LOOKUPS environment variable to true will also block the attack vector.
For Cloudflare WAF customers, three new managed rules are available to intercept exploit attempts. The mitigation is spread across three separate rules that inspect HTTP headers, the request body, and the URL, respectively. All three rules now default to a BLOCK action.
The vulnerability is rooted in the Log4j JNDI features used in configuration, log messages, and parameters. An attacker who can control log messages or their parameters can load arbitrary code from LDAP servers when message lookup substitution is enabled. The Apache Software Foundation maintains Log4j as a Java-based logging library.
Cloudflare says it continues to monitor the situation and will update its managed WAF rules accordingly. Additional technical details are available on the official Log4j security page.
