CVE-2021-45046— Apache Log4j 代码问题漏洞
一分钟漏洞结论
影响对象
Apache Software Foundation Apache Log4j
利用判断
已确认在野利用，应立即处置
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。 Apache Log4j 2.15.0版本存在代码问题漏洞，该漏洞源于当日志配置使用非默认模式布局和上下文查找或线程上下文映射模式使用 JNDI 查找模式制作恶意输入数据，从而导致拒绝服务攻击。
公开利用映射 2
Metasploit · 1
log4shell_scanner.rb#CVE-2021-45046 [auxiliary]
Nuclei · 1
CVE-2021-45046.yaml [template]
已观察到在野利用
cisa_kev · confirmed
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2021-45046 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
来源: CVE Program / CVE List V5
Vulnerability Description
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
表达式语言语句中使用的特殊元素转义处理不恰当(表达式语言注入)
来源: CVE Program / CVE List V5
Vulnerability Title
Apache Log4j 代码问题漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。 Apache Log4j 2.15.0版本存在代码问题漏洞，该漏洞源于当日志配置使用非默认模式布局和上下文查找或线程上下文映射模式使用 JNDI 查找模式制作恶意输入数据，从而导致拒绝服务攻击。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Log4j | Apache Log4j2 ~ 2.16.0 | - |
|
二、漏洞 CVE-2021-45046 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Windows Server Log4j Scanner - Powershell - CVE-2021-45046 and CVE-2021-44228 | https://github.com/X1pe0/Log4J-Scan-Win | POC详情 |
| 2 | Log4j 2.15.0 Privilege Escalation -- CVE-2021-45046 | https://github.com/cckuailong/Log4j_CVE-2021-45046 | POC详情 |
| 3 | Oh no another one | https://github.com/BobTheShoplifter/CVE-2021-45046-Info | POC详情 |
| 4 | Replicating CVE-2021-45046 | https://github.com/tejas-nagchandi/CVE-2021-45046 | POC详情 |
| 5 | None | https://github.com/pravin-pp/log4j2-CVE-2021-45046 | POC详情 |
| 6 | Public testing data. Samples of log4j library versions to help log4j scanners / detectors improve their accuracy for detecting CVE-2021-45046 and CVE-2021-44228. TAG_TESTING, OWNER_KEN, DC_PUBLIC | https://github.com/mergebase/log4j-samples | POC详情 |
| 7 | A simple script to remove Log4J JndiLookup.class from jars in a given directory, to temporarily protect from CVE-2021-45046 and CVE-2021-44228. | https://github.com/lukepasek/log4jjndilookupremove | POC详情 |
| 8 | None | https://github.com/ludy-dev/cve-2021-45046 | POC详情 |
| 9 | Log4j 漏洞本地检测脚本。 Scan all java processes on your host to check whether it's affected by log4j2 remote code execution vulnerability (CVE-2021-45046) | https://github.com/lijiejie/log4j2_vul_local_scanner | POC详情 |
| 10 | Log4Shell(CVE-2021-45046) Sandbox Signature | https://github.com/CaptanMoss/Log4Shell-Sandbox-Signature | POC详情 |
| 11 | None | https://github.com/shaily29-eng/CyberSecurity_CVE-2021-45046 | POC详情 |
| 12 | Apache Log4j2 Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45046.yaml | POC详情 |
| 13 | Apache Log4j2 Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. | https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2021/CVE-2021-45046.yaml | POC详情 |
| 14 | Apache Log4j2 Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. | https://github.com/projectdiscovery/nuclei-templates/blob/main/dast/cves/2021/CVE-2021-45046-DAST.yaml | POC详情 |
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2021-45046 的情报信息
请登录查看更多情报信息。
CVE-2021-45046 厂商安全公告 (13)
-
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf x_refsource_CONFIRM
-
https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
-
https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
-
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf x_refsource_CONFIRM
-
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf x_refsource_CONFIRM
-
https://www.cve.org/CVERecord?id=CVE-2021-44228 x_refsource_MISC
-
https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf x_refsource_CONFIRM
-
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html x_refsource_CONFIRM
-
https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
-
-
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd vendor-advisory x_refsource_CISCO
CVE-2021-45046 邮件列表归档 (5)
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ vendor-advisory x_refsource_FEDORA
-
-
-
CVE-2021-45046 其他参考 (3)
-
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 x_refsource_CONFIRM
-
https://logging.apache.org/log4j/2.x/security.html x_refsource_CONFIRM
同批安全公告 · Apache Software Foundation · 2021-12-14 · 共 3 条
| CVE-2021-4104 | Apache Log4j 代码问题漏洞 | |
| CVE-2021-44549 | Apache Sling Commons Messaging Mail 信任管理问题漏洞 |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-103636
Apache DataSketches C++ 变可选抽样反序列化越界读取导致拒绝服务漏洞 -
CVE-2026-103635
Apache DataSketches compact Theta sketch 反序列化越界读取导致拒绝服务漏洞 -
CVE-2026-103513
Apache DataSketches CPC反序列化越界读写漏洞 -
CVE-2026-103501
Apache DataSketches datasketches-cpp HLL CouponList 反序列化缓冲区溢 -
CVE-2026-103413
Apache Camel Karavan Kubernetes配置文件未验证漏洞
V. Comments for CVE-2021-45046
暂无评论