News
Vulnerability · Global · December 2021
Log4Shell in Apache Log4j (CVE-2021-44228)
A remote code execution flaw in the widely used Log4j logging library exposed countless applications and services.
Incident
What happened
Apache Log4j 2 evaluated lookup strings controlled by attackers in logged data, enabling remote code execution via JNDI.
Because Log4j is embedded in many products, organisations struggled to identify every affected system.
Widespread scanning and exploitation began within days of public disclosure.
Analysis
Lessons learned
An accurate software inventory is essential to respond to vulnerabilities in libraries.
Outbound network restrictions limit the impact of many exploitation techniques.
Dependencies inherited through products from other vendors must be included in vulnerability management.
Prevention
How penetration testing helps
Network and web application testing identify exposed services and vulnerable components, and validate whether mitigations are effective.
Sources
Summary based on publicly available information. DIGITPOL HK was not involved in this incident.