Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Vulnerability

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI [2][4]. The vulnerability arises because the JDBC Appender does not restrict the protocol used in JNDI data source names, allowing an attacker to specify an LDAP URI that points to a malicious LDAP server [4].

Exploitation

An attacker must have permission to modify the Log4j2 logging configuration file [4]. With that access, the attacker can construct a malicious configuration that includes a JDBC Appender with a data source referencing a JNDI LDAP URI. When the application processes the configuration, Log4j2 will connect to the attacker-controlled LDAP server, which can return a serialized Java object that leads to remote code execution [4].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the target system with the privileges of the application using Log4j2 [2][4]. This can lead to full compromise of the affected system, including data exfiltration, installation of malware, or further lateral movement within the network.

Mitigation

The issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2 [2][4]. Users should upgrade to these versions or later. If upgrading is not immediately possible, ensure that logging configuration files are protected from unauthorized modification [4]. No workaround is available that does not involve upgrading or restricting configuration file access.