Vulnerability Watch

Forum Discussion

Anonymous's avatar
Anonymous
4 years ago

Proof-of-Concept for Critical Apache Log4j Remote Code...

Proof-of-Concept for Critical Apache Log4j Remote Code Execution Vulnerability Available (CVE-2021-44228)

On December 9, researchers published proof-of-concept (PoC) exploit code for a critical vulnerability in Apache Log4j 2, a Java logging library used by a number of applications and services including but not limited to:

Dubbed Log4Shell by researchers, CVE-2021-44228 is a remote code execution vulnerability in Apache Log4j 2. Apache released 2.15.0 on December 10 to address this vulnerability.

Tenable will be releasing plugins and scan templates for Tenable.io, Tenable.sc and Nessus Professional as soon as possible. Organizations that don’t currently have a Tenable product can sign up for a free trial of Nessus Professional to scan for this vulnerability.

For more information and ongoing updates, please visit our blog.

13 Replies

  • Anonymous's avatar
    Anonymous
    4 years ago

    Thanks Tills, just to confirm, I still do not see any list of available plugins for this vulnerability. However, the banner on this site may be a bit misleading as it says to check "this list of plugins" which still returns no results.

    Also, any ETA on when Tenable will have the plugin ready?

    • scaveza's avatar
      scaveza
      Product Team
      4 years ago

      Hi Jeff,

      The following plugins are available and in the plugins feed. If you have not already, please update your plugins and ensure the feed serial is 202112110647.

      The plugin IDs are below:

      155998   Apache Log4j Message Lookup Substitution RCE (Log4Shell) (Direct Check)

      155999   Apache Log4j < 2.15.0 Remote Code Execution

      156000   Apache Log4j Installed (Unix)

      156001   Apache Log4j JAR Detection (Windows)

      156002   Apache Log4j < 2.15.0 Remote Code Execution

      We're working with our teams to ensure the plugin search page properly reflects these new plugins.

      • keith_mccullum's avatar
        keith_mccullum
        Connect Contributor
        4 years ago

        Plugins still aren't searchable.

        I'm trying to figure out if any of them are "remote" type but three are encrypted. The other two have readable source code and confirmed as "local" type, meaning they only will detect for authenticated scans and are useless for detecting an externally-exploitable vulnerability.

  • Anonymous's avatar
    Anonymous
    4 years ago

    Same issue here, Keith, I'm confused why there's not a plugin for unauthenticated scans since that's exactly how attackers are scanning for vulnerable hosts...

    Just forced plugin updates and not seeing them when I search either.

    • keith_mccullum's avatar
      keith_mccullum
      Connect Contributor
      4 years ago

      I manually "updated" the feeds for Tenable.SC and Active Plugins from within my on-prem SC instance. The plugin IDs were then searchable in the "Plugins" page under the username dropdown menu. That's how I found which were local and which were encrypted.

      Waiting on hold for a support engineer, but my hope is that 155998 "Apache Log4j Message Lookup Substitution RCE (Log4Shell) (Direct Check)" is a remote check, as most of the previous "Direct Check" plugins for similar vulns are remote type.

  • Anonymous's avatar
    Anonymous
    4 years ago

    Ahhh, a saint among men!

    I see the plugins now, much appreciated. To save another case, could you post what support tells you? That'll remove confusion for those who see this feed...(And me, selfishly) :-)

    • keith_mccullum's avatar
      keith_mccullum
      Connect Contributor
      4 years ago

      Happy to help! And yeah, I'll post back with the response from support.

  • keith_mccullum's avatar
    keith_mccullum
    Connect Contributor
    4 years ago

    Confirmed with TSE, plugin 155998 "Apache Log4j Message Lookup Substitution RCE (Log4Shell) (Direct Check)" is a remote type. The other four (155999-156002) are local.

  • Anonymous's avatar
    Anonymous
    4 years ago

    You are the man, appreciate the follow-up. Godspeed to everyone fighting the good fight! ;-)

  • Anonymous's avatar
    Anonymous
    4 years ago

    Hi , This plugin id = 155998 doesn't show up on Tenable.io .I am able to see other plugin ids but specifically 155998  this one doesn't up on the filters. Could you please help me?

    • scaveza's avatar
      scaveza
      Product Team
      4 years ago

      You will need to ensure that your plugins are up to date. The following Nessus CLI command should update your plugin set to the most current version:

      nessuscli fix --secure --delete feed_auto_last

      For further information and ongoing updates, please visit our blog.

  • Anonymous's avatar
    Anonymous
    4 years ago

    There are no plugins related with log4shell visible on filter plugin on Scan templates in Tenable.io , so how can we expect to be sure that plugins are already loaded ?

  • Anonymous's avatar
    Anonymous
    4 years ago

    I run log4shell scan over assets that have the issue but are not been detected. A regular advanced network scan (with credentials) neither is detecting?. I am trying without credential. But I doubt that I will work, cause I could not see plugins on scan template. Is the someone from Tenable Support that could say what is happening?

Recent Discussions