Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild
Summary: Cisco Talos released Snort SIDs 58722-58744, 58751, 58784-58790, 58795, 58801, 58811-58814 and ClamAV signatures to address CVE-2021-44228, CVE-2021-45046, and CVE-2021-45105, a remote code execution flaw in the Apache Log4j library that carries a maximum CVSS score of 10.0 and can be exploited in default configurations by an unauthenticated remote attacker. Talos observed attacker activity tied to CVE-2021-44228 beginning Dec. 2, 2021, with unverified reports dating to as early as Dec. 1, and reports activity from miners, other financially motivated attackers, and nation state actors.
What's compelling: A maximum 10.0 severity flaw in a logging library embedded across enterprise Java applications, including Apache Struts 2, Apache Solr, and Elastic, means an unauthenticated attacker could take complete control of an affected server, and Talos advises backdating analysis at least several weeks because exploitation may have occurred well before the dates it observed.