Loading...

Watch: Detect Apache Log4j CVE-2021-44228 with Ansible Playbook

Use Ansible to automate the detection of Apache Log4j CVE-2021-44228 vulnerability. Follow this guide to set up and run detection scripts efficiently.

How to automate the Detector Log4Shell Remote Code Execution Log4j (CVE-2021–44228)?

I'm going to show you a live Playbook with some simple Ansible code.

I'm Luca Berton and welcome to today's episode of Ansible Pilot.

Log4Shell Remote Code Execution Log4j (CVE-2021–44228)

Remember 2014? Heartbleed was a bug in OpenSSL, the most popular open-source code library for Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols usage in encrypting websites and software. At the time the flaw allowed to read confidential information allowing the hackers to trick a vulnerable web server with encryption keys.

Back to the present!

Log4j - the Java program compromised by the Log4Shell bug - is a widely used, multi-platform open-source Java logging framework library developed and maintained under the volunteer Apache Software Foundation. Log4j is widely used on servers to record users' activities to analyze later by security or development teams.

Hackers could use the Log4Shell flaw to access sensitive information on a variety of devices, plant ransomware attacks, and take over machines to mine cryptocurrencies. The vulnerability was discovered almost by happenstance when Microsoft announced it had found suspicious activity in Minecraft: Java Edition, a popular video game it owns.

The flaw was officially founded by Chen Zhaojun of Alibaba's Cloud Security Team on the 24th of November 2021.

Some estimation to Wiz and EY, the vulnerability affected 93% of enterprise cloud environments. Affected commercial services include Amazon Web Services, Cloudflare, iCloud, Minecraft: Java Edition, Steam, Tencent QQ, and many others.

Links

  • https://en.wikipedia.org/wiki/Log4Shell
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
  • https://access.redhat.com/security/vulnerabilities/RHSB-2021-009
  • https://news.sophos.com/en-us/2021/12/17/inside-the-code-how-the-log4shell-exploit-works/

Red Hat detector

version 1.2 release 2021-12-20

  • [cve-2021-44228--2021-12-20-1836.sh](https://access.redhat.com/sites/default/files/cve-2021-44228--2021-12-20-1836.sh)
  • [cve-2021-44228--2021-12-20-1836.sh.asc](https://access.redhat.com/sites/default/files/cve-2021-44228--2021-12-20-1836.sh.asc)

version 1.3 release 2022-01-10

  • [cve-2021-44228--2022-01-10-1242.sh](https://access.redhat.com/sites/default/files/cve-2021-44228--2022-01-10-1242.sh)
  • [cve-2021-44228--2022-01-10-1242.sh.asc](https://access.redhat.com/sites/default/files/cve-2021-44228--20

Read the full tutorial: Detect Apache Log4j CVE-2021-44228 with Ansible Playbook