Security Advisory WSO2-2021-1720

Published: March 08, 2022

Version: 1.0.0

Severity: Critical

CVSS Score: 10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

AFFECTED PRODUCTS

  • WSO2 Integration Studio : 8.0.0 and Below

OVERVIEW

Log4j remote code execution zero-day vulnerability (CVE-2021-44228) - Log4j 2.17.0 update.

DESCRIPTION

Security advisory contents from Apache Log4j2 is as follows [1][2]:

Apache Log4j2 <=2.14.1 JNDI features used in the configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.

This upgrade cumulatively mitigates known vulnerabilities of Log4j 2 prior to 2.17.0 relevant to the following dependencies:

  • log4j-core upgraded to v2.17.0
  • log4j-api upgraded to v2.17.0
  • log4j-jcl upgraded to v2.17.0
  • pax-logging-log4j2 to v1.11.12
  • org.ops4j.pax.logging.pax-logging-log4j2 to v1.11.12

IMPACT

By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by providing a crafted payload.

SOLUTION

The recommended solution is to migrate the latest version of WSO2 Integration Studio which is WSO2-Integration-Studio-8.0.1.