CVE-2021-45046 Log4Shell

In summary:

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern, resulting in a denial of service (DoS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as setting the system property log4j2.noFormatMsgLookup to true do NOT mitigate this specific vulnerability. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVE-2021-45046 does not impact Cascade Cloud as of 3/8/2022 or on-premise Cascade CMS 8.20, because the latest version of Log4j 2.x is in use, which disables the affected JNDI functionality by default.

Note that application logging configuration is not available within the application itself. It can only be customized with direct access to the application server.

On-premise distributions older than Cascade CMS 8.20

On-premise distributions of Cascade CMS are also not impacted by default. We do not make use of the affected JNDI substitution in our distribution. That said, if Cascade CMS on-premise logging has been customized in any way, ensure the affected JNDI substitution is not being used.

Further mitigation

You can take the additional step of removing the affected class from the log4j jar file. You'll need to do this for each and every upgrade until another solution exists.

To do this:

• Navigate to tomcat/webapps within the Cascade CMS home directory.
• You'll need to modify the log4j file not only in the unpacked ROOT directory but also in the bundled ROOT.war, if it exists.

• For the unpacked version, navigate to ROOT/WEB-INF/lib. With access to the zip tool, you can run:

  Bash Copy

  $ zip -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
      $ deleting: org/apache/logging/log4j/core/lookup/JndiLookup.class

  If you don't have access to zip, you'll need to use something like the jar or unzip tool to unpack, remove the affected class, and repack it.

• For the version bundled in the WAR file, unpack the WAR file to a temp directory from the webapps directory:

  Bash Copy

  $ mkdir temp
      $ cd temp
      $ jar xzf ../ROOT.war

  With access to the zip tool, you can run:

  Bash Copy

  $ zip -d WEB-INF/lib/log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
      $ deleting: org/apache/logging/log4j/core/lookup/JndiLookup.class

  Repack the WAR file. From inside the temp directory:

  Bash Copy

  jar cvf ROOT.war *

  Then replace the older one, keeping the original as a backup. From webapps:

  Bash Copy

  rm ROOT.war
      mv temp/ROOT.war .
      rm -rf temp

• Alternatively, if you haven't customized the unpacked WAR file, you can delete the entire ROOT directory, skip the first step, and make the modifications to ROOT.war only.

On-premise distributions older than 8.x

As was the case for CVE-2021-44228, CVE-2021-45046 does not impact on-premise distributions of Cascade CMS older than 8.x, because message lookup substitution is not supported in our use of log4j.