Apache Log4j vulnerability and fixes

Description

CVE-2021-44224

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). For more information, see: CVE-2021-44224 - Hosted codebeamer clients affected

Source: CVE-2021-44224

CVE-2021-44228

Apache Log4j <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.

Source: Apache Log4j Security Vulnerabilities

CVE-2021-45046

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property log4j2.noFormatMsgLookup to true do NOT mitigate this specific vulnerability. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Source: Apache Log4j Security Vulnerabilities

None of the codebeamer versions are affected by this security issue, user input is not used in Thread Context Map or Context Lookup.

CVE-2021-45105

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process. This is also known as a DOS (Denial of Service) attack.

Source: Apache Log4j Security Vulnerabilities

None of the codebeamer versions are affected by this security issue, user input is not used in Thread Context Map or Context Lookup.

CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

None of the codebeamer versions are affected by this security issue, JDBC Appender is not used by codebeamer by default.

Fixing the issue

Codebeamer uses two versions of Apache Log4j:

• codebeamer 20.11: Log4j 2.12.0
• codebeamer 21.04: Log4j 2.14.0
• codebeamer 21.09: Log4j 2.14.0

To mitigate the issue (CVE-2021-44228, CVE-2021-45046), Intland Software releases codebeamer 20.11-SP13 (Release Notes 20.11-SP13), and codebeamer 21.09-SP4 (Release Notes 21.09-SP4) with an upgrade to Log4j 2.16.0. To fix the issue, install the corresponding service pack.

To mitigate the issue without updating to a new service pack, follow the relevant steps below.

Patch

• 20.11-SP13 available: 20.11-SP13 download.
• 21.09-SP4 available: 21.09-SP4 download.

Hosted clients

• CVE-2021-44228 - On all systems hosted by Intland Software, the fix has been applied.
• CVE-2021-45046 - Hosted clients are not affected by this security issue.
• CVE-2021-45105 - Hosted clients are not affected by this security issue.
• CVE-2021-44832 - Hosted clients are not affected by this security issue.

Fix for CVE-2021-44228

This fix works with:

• codebeamer 20.11
• codebeamer 21.04
• codebeamer 21.09

In Log4j 2.12.0 and 2.14.0 (both codebeamer supported versions), this issue can be solved by setting the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true.

• Setting environment variables on Windows: Create and Modify Environment Variables on Windows.
• Setting environment variables on Linux: How to Set and List Environment Variables in Linux.

After setting environment variables, restart codebeamer.

Fix for CVE-2021-442288 and CVE-2021-45046 (Linux only)

To mitigate the issue, users have to remove the JndiLookup class from the classpath, by following these steps:

1. Stop codebeamer.
2. Open a terminal.
3. Run the following command to navigate to the following directory (replace the parts between <...> characters):
   cd <codebeamer install direrctory>/tomcat/webapps/<context>/WEB-INF/lib
4. Run the following commend to remove the JndiLookup class:
   zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
5. Start codebeamer.

Fix for CVE-2021-442288 and CVE-2021-45046 (Windows and Linux)

To mitigate the issue, users have to replace the log4j-*.jar files:

1. Download the following files:
   • log4j-jul-2.17.1.jar
   • log4j-slf4j-impl-2.17.1.jar
   • log4j-1.2-api-2.17.1.jar
   • log4j-api-2.17.1.jar
   • log4j-core-2.17.1.jar
2. Stop codebeamer.
3. Navigate to the following folder: <codebeamer install direrctory>/tomcat/webapps/<context>/WEB-INF/lib
4. Replace the older versions of the files with the new version, the log4j-*-2.14.0.jar, or the log4j-*-2.15.0.jar with the downloaded 2.17.0 versions (delete the old files).
5. Navigate to the following folder: <codebeamer install direrctory>/repository/scmloop
6. Replace the either the log4j-api-*.jar, log4j-1.2-api-*.jar, and the log4j-core-*.jar files with the downloaded 2.17.0 versions (delete the old files).
7. Restart codebeamer.

Fix for codebeamer 21.09-SP2 in docker container

For more information, see: How to replace Log4j jars in docker container.

Testing the fix

This site provides help in testing whether fixing the issue was successful: https://log4shell.huntress.com/

To run the test, follow these steps:

1. Copy the generated JNDI syntax (the part with ${jndi:ldap:...}) into the following cURL command: curl -v -H 'User-Agent: ${jndi:ldap:<your generated JNDI>}' https://codebeamer.com/cb/login.spr
2. Paste the full command into a terminal/command line and run it.
3. If the fix was successful, the results page on https://log4shell.huntress.com/ (click on the [View connections] button) is empty:
   
4. If the fix was unsuccessful, the connection will be successful, and it gets listed on the results page of https://log4shell.huntress.com/: