Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228) (Updated)
Summary: On Dec. 9, 2021, a remote code execution vulnerability in Apache Log4j 2 (CVE-2021-44228) was identified being exploited in the wild, with public proof-of-concept code released and exploitation described as incredibly easy to perform via a specially crafted request. Palo Alto Networks telemetry recorded 125,894,944 signature hits between Dec. 10, 2021 and Feb. 2, 2022, with a large spike Dec. 12-16 and another on Jan. 1, 2022, and 54% of hits in the Dec. 10-31 window generated by internal scanning.
What you should know: Over 49% of the 70,577,055 exploit strings extracted from packet captures sat in the top six fields of the HTTP request, and observed post-exploitation activity ranged from backdoors and data exfiltration to Kinsing coinminer installation - meaning any Java application logging unsanitized user input was a candidate, whether or not anyone had inventoried it.