Cloudflare rules also cover second Log4j RCE flaw
Shortly after the disclosure of CVE-2021-44228, another Log4j vulnerability has been filed as CVE-2021-45046. The mitigation rules Cloudflare previously released for the earlier flaw provide the same level of protection against this new CVE, according to the company.
The vulnerability is being actively exploited, and anyone using Log4j should upgrade to version 2.16.0 as soon as possible — including those who already moved to 2.15.0. The latest release is available on the Log4j download page.
Customers of the Cloudflare WAF have three rules available to help mitigate exploit attempts. The mitigation is split across three rules that inspect the HTTP header, body, and URL, respectively.
In addition, a fourth rule has been released that protects against a much wider range of attacks, at the cost of a higher false positive rate. Cloudflare has made that rule available but has not set it to BLOCK by default.
Who is affected
Log4j is a Java-based logging library maintained by the Apache Software Foundation. In all Log4j versions >= 2.0-beta9 and <= 2.14.1, JNDI features in configuration, log messages, and parameters can be exploited for remote code execution. An attacker who can control log messages or their parameters can run arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
The mitigations shipped in version 2.15.0 for CVE-2021-22448 were not sufficient to protect against this new CVE-2021-45046.
