nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

ArcGIS Enterprise Log4j Vulnerability (CVE-2021-44228) Patch or Mitigation?

Carl_Flint

Good afternoon, is there any patches in the works or potential mitigation steps for the latest java log4j vulnerability (CVE-2021-44228)? I know that GeoEvent server uses log4j and can assume some other enterprise server's or portal potentially do as well. Any help would be appreciated in resolving this zero-day.

Thanks,

Encontre mais publicações marcadas com

Accepted answers

RandallWilliams

Our current statement is available on https://trust.arcgis.com. Look for more updates as this issue evolves.

All comments

ALLANGILLIS

That version of Log4J is not affected. Only versions 2.0 - 2.14.1

https://www.zdnet.com/article/log4j-zero-day-flaw-what-you-need-to-know-and-how-to-protect-yourself/

RandallWilliams

Sorry for the delayed reply. I see what you're saying, we made a backup when you upgraded. That's a backup in case your upgrade failed and you needed to bail out. I'd maybe archive it on an offline drive and just delete that directory.

ChristophK

WAF filters like that can be easily circumvented with other nested filters, like lower/uppercase functions (lower:j, lower:n ...)

It won't allow me to post an example, but I hope the idea is clear.

RexRobichaux

Hey Thomas- I posted a video link a few comments down. Hope it's helpful.

-Rex

RandallWilliams

Restating under my Esri profile for clarity:

Please continue to follow the advisory we've published. There have been and will continue to be updates as the day progresses.

We have spent considerable time performing internal security testing, and there is no evidence of any proven exploit vectors for remote code execution (RCE) in any version of a base ArcGIS Enterprise deployment (including ArcGIS Server, Portal for ArcGIS, and ArcGIS Data Store). This means that while several components of ArcGIS Enterprise incorporate different versions of Log4J across all versions of ArcGIS Enterprise, there are no known ways to exploit this vulnerability. 10.8.x is mitigated: ArcGIS Enterprise versions 10.8 and higher use newer versions of the Java Runtime Environments (JRE) that do not allow for execution of remotely loaded code. On these versions of ArcGIS Enterprise, even hypothetical future remote exploit vectors are presumed to be mitigated.

Please continue to refer to the advisory we've posted as the source of truth from Esri regarding this evolving issue.

RandallWilliams

Lol, yes it's me. I have both corporate and my AGO profiles. I changed my AGO username years ago when doing some fuzz testing. Sorry for the confusion.

ThomasIllingworth

Hi Randall

Quick question is there a guide anywhere for setting up the environment variable for ArcGIS anywhere? Never set up one myself before

Thanks

Tom

AndrewFarrar

@RandallWilliams , just confirming that this post was actually from you?

RandallWilliams

You'll need to restart all ArcGIS Enterprise components for the processes to pick up the environment variable.

RandallWilliams

blocking stings like ${jndi will mitigate this issue.

JohnBrockwell

I am not taking that remediation action(s). I am getting all my environments to 10.8.1. I was in pretty good shape to begin with.

The one piece of advice I would give is don't fret about an outage. Accept a short term outage to avoid a long term one.

SebastienPelletier

Question, when we set the variable LOG4J_FORMAT_MSG_NO_LOOKUPS, do we need to restart the server or ArcGIS Server?

rshihab

Hi John

does the WAF applied to the ArcGIS enterprise hosted locally or just to azure . does applying . do the attached settings below enough

JohnBrockwell

Getting Off Topic. Please keep it to:
Log4j Vulnerability (CVE-2021-44228)

berniejconnors

Yes, MichaelDavis3, that is our experience with ArcGIS Server upgrades too. Our last upgrade project took us from 10.2.2 to 10,7,1 and it lasted two years and was fraught with peril, problems, testing and performance tuning, lots of performance tuning.

Bernie.

MichaelDavis3

Thanks randoodlydingdangdodlyWilliams... if that is your real name. It would be great if ESRI could include guidance or advice on the "fix" applied by tools like this: https://github.com/logpresso/CVE-2021-44228-Scanner

I understand you would prefer everyone update their ArcGIS Enterprise servers to 10.8.1+ but here it is 2021 and ArcGIS Server upgrades continue to be multi-day affairs, fraught with peril, requiring system snapshots and frequently failing and requiring rollbacks. There is a reason so many customers are not on the latest version of AGS.

MichaelDavis3

See this link for details: https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/

Essentially someone can trigger a URL and download a payload if Log4j has access to the internet. The application doesn't have to have anything to do with LDAP it's just a way to trigger the URL.

With a : present in the key, as in Example Removed to get through ESRI WAF there’s no prefix and the LDAP server is queried for the object. And these Lookups can be used in both the configuration of Log4j as well as when lines are logged.
So all an attacker has to do is find some input that gets logged and add something like Example Removed to get through ESRI WAF. This could be a common HTTP header like User-Agent(that commonly gets logged) or perhaps a form parameter like username that might also be logged.

BrianParker2

I had a question about the risk. Based on what I can find out, the risk would only apply to externally facing LDAP and other JNDI related endpoints? applications such as GeoEvent Server, GIS Portal or Geoportal implementations?

Internal implementations of ArcGIS Server or even External implementations that don't use Active DIrectory, from what I can tell, should be risk free. Is this correct?

RandallWilliams

Aaron-L

Can someone from ESRI please provide an ETA on a patch?

It is very worrisome to be running a version of log4j that is on the vulnerable list and just hoping that it is "mitigated" as stated in the ESRI Blog.

JohnGibson2

Good point about 10.3.1, thanks Erik. ArcGIS Servers (v.10.3.1) use log4j v1.2.12 which is however vulnerable to some much older but lesser issues - see https://logging.apache.org/log4j/1.2/. This has a threat score CVSS of 7.5 and this threat has been around for many years. There is no fix.

ErikLash_HiCo

Ran the Github check:

10.9.1 GIS Server ships with log4j 2.14.1. Have not checked other components in 10.9.1
10.8.1 Enterprise has a mix including 2.11.1

ESRI public release states (for 10.8.x and up) that "You will still see vulnerable Log4j version numbers on these systems, however it is not exploitable as their Java Runtime Environments (JRE) do not execute the code."

Be careful with logic when thinking that 10.3.1 and other older versions with 1.x are not vulnerable simply because not popping in the check.

From Apache for those on older/EOL Enterprise: Please note that Log4j 1.x has reached end of life and is no longer supported. Vulnerabilities reported after August 2015 against Log4j 1.x were not checked and will not be fixed.

Hope this helps.

JohnGibson2

The utility available at GitHub - logpresso/CVE-2021-44228-Scanner: Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228 looks like a useful check.

Using the utility on ArcGIS Server 10.3.1 (Server only, no extensions) on Windows Server lists no vulnerabilities.

Using the utility on ArcGIS Server 10.6.1 (Server only, no extensions) on Windows Server lists the following issues :

C:\Users\bloggsj>D:\Temp\Utilities\log4j2-scan.exe "C:\Program Files\ArcGIS"
[*] Found CVE-2021-44228 vulnerability in C:\Program Files\ArcGIS\Server\framework\lib\shared\log4j-core-2.8.2.jar, log4j 2.8.2
[*] Found CVE-2021-44228 vulnerability in C:\Program Files\ArcGIS\Server\tools\configurebasedeployment\lib\log4j-core.jar, log4j 2.8.2
[*] Found CVE-2021-44228 vulnerability in C:\Program Files\ArcGIS\Server\tools\createsite\lib\log4j-core.jar, log4j 2.8.2
[*] Found CVE-2021-44228 vulnerability in C:\Program Files\ArcGIS\Server\tools\upgradebasedeployment\lib\log4j-core.jar, log4j 2.8.2
[*] Found CVE-2021-44228 vulnerability in C:\Program Files\ArcGIS\Server\tools\upgradeserver\lib\log4j-core.jar, log4j 2.8.2

Scanned 5264 directories and 45936 files
Found 5 vulnerable files
Completed in 22.24 seconds

Regards

John

GianniCampanile2

Hi Adrian,

the mitigation statement is for 10.8.1 version, while regarding 10.9 it says "We recommend updating to the latest version of 10.9.1 for the strongest security posture" and I can't figure out if it's a solution or just a generic recommendation.

Gianni

SreehariGomasani

How do I check the Log4j Vulnerability to my current system? As I am currently using ESRI Enterprise 10.4

adrian.marsden_DevonCC

the blog says "mitigated" with 10.9 - "to make (something) less severe, harmful, or painful. "

SPi_OS

I am on ArcGIS Server 10.6.1

I have found this Jar, which I think is affected :

"C:\Program Files\ArcGIS\Server\framework\lib\shared\log4j-core-2.8.2.jar"

Following the suggestions from

https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/

I am going to delete from that Jar:

org/apache/logging/log4j/core/lookup/JndiLookup.class

I am also going to add the System environment variable

LOG4J_FORMAT_MSG_NO_LOOKUPS=true

Then reboot

Question: Are there any other Jars to fix or reconfigure?

adrian.marsden_DevonCC

looking at my servers, some have log4j 2.x, some don't - I realize it is still early on this, but an exact matrix of what does and doens't have this would be really useful.

GianniCampanile2

Hi Randall,

the statement does not make clear a couple of important points:

- does 10.9.1 version definitevely solves the problem ?

- is the problem only for ArcGIS Enterprise JAVA version or also for .Net one ?

Thanks

Gianni

Anonymous User

we use some older installs of ArcGIS Server (10.3.1 and 10.6.1). Scanning the install for log4j shows only older versions of log4j under C:\Program Files\ArcGIS\Server\framework dated 2005 and with version 1.2.12 in the manifest. I could not find any reference to the class or function names cited in the CVE-2021-44228 advisory. My initial thought is that these versions of ArcGIS Server do not use log4j v2 and may not be vulnerable as a result.

I used this command from CMD using the Java SDK utility jar.exe to list the Java classes :

C:\Program Files\ArcGIS\Server\framework>forfiles /S /M *.jar /C "cmd /c jar -tvf @file | findstr /C:"log4j" && echo @path" > C:\Temp\log4j_info.txt

(see https://www.windows-commandline.com/search-classes-in-jar-file/)

Unzipping a copy of a Jar file (rename & unzip) shows the version in the manifest.mf file

Regards

John

PhilipOrlando

Following.

RandallWilliams

Our current statement is available on https://trust.arcgis.com. Look for more updates as this issue evolves.

Swani_Jesus_Captonsiluvairajan

Do we have any updates on this? Do we have to shutdown the portal and server services as a precaution?

MarkusRuottinen

Do you know is it possible to set environment variables which ArcGIS Server uses in windows server.?

I ask this because https://logging.apache.org/log4j/2.x/security.html says: "Mitigation: In releases >=2.10, this behavior can be mitigated by setting either the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true. "

I just ask, I don't know is this correct solution.

Markus

Kai_Ole_Rogge_Allianz

ArcGIS Enterprise base deployment shows more then 50 affected .jar files (Esri and 3rd party like Elasticsearch).

Looking forward to any updates/patches/support.

Cheers
Kai

MarkusRuottinen

Also following.

Scott_Tansley

Following. Thanks for raising.

allmoag

also interested

JohnBrockwell

I found it here on my Portal for ArcGIS server:

E:\arcgisportal\upgrade-backup\10.5.1\dsdata\elasticsearch_2.3.2\lib

File Name:

apache-log4j-extras-1.2.17.jar

The file is located in a 10.5.1 backup folder. I am currently running 10.8.1. Does it matter?

AndresEcheverri

Really interested on this topic too.

JoshuaBixby

A quick filesystem search on a stand-alone ArcGIS Server installation shows numerous components using log4j. This won't just be about patching a file, but lots of files involving multiple components of multiple products. A not-so-happy holidays for Esri dev teams.

IngaPlayle1

I'm also waiting to hear any news from ESRI about this.

Participe da Conversa

Membros conectados podem postar, seguir atualizações e mais. Novo aqui? Registre uma conta gratuita.

Links Rápidos

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.