Log4Shell

securityprogramming

The 2021 vulnerability in the ubiquitous Log4j logging library that let a logged string execute arbitrary code.

Because Log4j is embedded in countless Java applications, a crafted string in something as innocent as a username or user agent could trigger remote code execution almost anywhere. Its reach and severity made it one of the most serious and widespread flaws ever disclosed.

Log4Shell was a vulnerability in Log4j, a Java logging library, where a specially formatted string in any logged text would cause the library to fetch and execute remote code through JNDI lookup. The exploit string was short enough to fit in a username, a chat message, or a device name.

The severity came from the combination of trivial exploitation and near-universal presence. Anything that logged user input was potentially vulnerable, which is essentially everything, and Java runs a large fraction of enterprise backends. Proof of concept exploitation required no authentication and no unusual conditions, and within days people were changing their phone names to exploit strings to see what would call home.

The lasting consequence was about supply chain visibility rather than about Java. Organizations discovered they could not answer whether they used Log4j, because it arrived as a transitive dependency inside products they had bought, and vendors took weeks to say which of their own products were affected. That gap is what drove software bills of materials from a compliance idea into something regulators now expect, and the honest position is that most organizations still could not answer the question quickly today.

Also known as: Log4Shell, CVE-2021-44228, Log4j vulnerability

← All glossary entries