Disclaimer: This threat is rapidly evolving by the hour. Unit 42 researchers are updating this Unit 42 blog in real time, and therefore the blog serves as our single source of truth. The information provided is for general informational purposes only.
On December 9, a remote code execution (RCE) vulnerability in Apache Log4j 2 was identified as being exploited in the wild. Apache Log4j is an open-source logging utility that is leveraged within numerous Java applications around the world. The release of public proof-of-concept (PoC) code and subsequent investigation revealed that the exploitation was incredibly easy to perform. By submitting a specially crafted request to a vulnerable system, the attacker can instruct the system to download and subsequently execute a malicious payload. Due to its recent discovery, there are still many on-premises and cloud servers that have yet to be patched.
The exploit code for the CVE-2021-44228 vulnerability has been made publicly available, and massive scanning activity has begun on the internet with the intent of seeking out and exploiting unpatched systems. The Unit 42 Threat Intelligence and product development teams continue to monitor this situation for additional details and updates and will share the latest information on the exploit and how to defend against it.
Register now for a webinar with Jen Miller-Osborn, deputy director for the Unit 42 threat research team, to learn:
Key details and an analysis of the vulnerability
How to determine whether your organization is vulnerable
What Palo Alto Networks products can do to prevent this vulnerability from being exploited