Apache Log4j2 vulnerability

A possible exposure of Apache Log4j2 JNDI features to attacks via log messages and log message parameters requires immediate action for some censhare services. In this security update article, you find the necessary actions to fix any possible third-party vulnerability.

Affected censhare versions and services

The vulnerability affects Spring Boot applications with log4j 2.14.1 and lower. In censhare, this affects the Social Media service, Google Cloud AI service, Cloud Gateway and the Static Resource Server (SRS).

Required actions

As an immediate action to mitigate a possible vulnerability, on the Java Virtual Machince of the affected services, set argument –Dlog4j2.formatMsgNoLookups=True:

Cloud Gateway

1. Login to the server where the Cloud Gateway package is installed.
2. Edit the file /usr/lib/systemd/system/censhare.cloud-gateway.service:
3. Under WorkingDirectory, add the line: EnvironmentFile=-/etc/sysconfig/censhare-cloud-gateway
4. In the line ExecStart, append ${JAVA_OPTS}

5. The file should look like this:

   CODE

   [Unit]
   Description=censhare springboot service for Cloud Gateway.
   After=network-online.target
   
   [Service]
   Type=simple
   WorkingDirectory=/opt/censer/cloud-gateway
   EnvironmentFile=-/etc/sysconfig/censhare-cloud-gateway
   ExecStart=/usr/bin/java -jar /opt/censer/cloud-gateway/cloud-gateway.jar ${JAVA_OPTS}
   Restart=on-abort
   User=censer
   Group=censer
   StandardOutput=syslog
   StandardError=syslog
   SyslogIdentifier=cloud-gateway
   
   [Install]
   WantedBy=multi-user.target

6. Create the file /etc/sysconfig/censhare-cloud-gateway with the following contents:
   JAVA_OPTS="–Dlog4j2.formatMsgNoLookups=true"

7. Restart the systemd service: 

   CODE

   systemctl daemon-reload 
   systemctl restart censhare.cloud-gateway

8. Verify that the command-line parameter took effect with the following command:

   CODE

   ps aux | grep [c]loud-gateway

9. The result should look as follows:
   

   CODE

   censer    <omitted> /usr/bin/java -jar /opt/censer/cloud-gateway/cloud-gateway.jar –Dlog4j2.formatMsgNoLookups=true

   
   

Static Resource Server

1. Login to the server where the Static Resource Server package is installed.
2. Edit the file /usr/lib/systemd/system/censhare.static-resource-server.service:
3. Under WorkingDirectory, add the line: EnvironmentFile=-/etc/sysconfig/censhare-static-resource-server
4. In the line ExecStart, append ${JAVA_OPTS}

5. The file should look like this:

   CODE

   [Unit]
   Description=censhare springboot service for Static Resource Server.
   After=network-online.target
   
   [Service]
   Type=simple
   WorkingDirectory=/opt/censer/static-resource-server
   EnvironmentFile=-/etc/sysconfig/censhare-static-resource-server
   ExecStart=/usr/bin/java -jar /opt/censer/static-resource-server/static-resource-server.jar ${JAVA_OPTS}
   Restart=on-abort
   User=censer
   Group=censer
   StandardOutput=syslog
   StandardError=syslog
   SyslogIdentifier=static-resource-server
   
   [Install]
   WantedBy=multi-user.target

6. Create the file /etc/sysconfig/censhare-static-resource-server with the following contents:
   JAVA_OPTS="–Dlog4j2.formatMsgNoLookups=true"

7. Restart the systemd service: 

   CODE

   systemctl daemon-reload 
   systemctl restart censhare.static-resource-server

8. Verify that the command-line parameter took effect with the following command: 

   CODE

   ps aux | grep [s]tatic-resource-server

9. The result should look something like this: 

   CODE

   censer    <omitted> /usr/bin/java -jar /opt/censer/static-resource-server/static-resource-server.jar –Dlog4j2.formatMsgNoLookups=true

Google AI

1. Login to the server where the Google AI integration package is installed.
2. Edit the file /usr/lib/systemd/system/censhare.google-ai.service:
3. Under WorkingDirectory, add the line: EnvironmentFile=-/etc/sysconfig/censhare-google-ai
4. In the line ExecStart, append ${JAVA_OPTS}

5. The file should look like this: 

   CODE

   [Unit]
   Description=censhare springboot service for Google-AI.
   After=network-online.target
   
   [Service]
   Type=simple
   WorkingDirectory=/opt/censer/google-ai
   EnvironmentFile=-/etc/sysconfig/censhare-google-ai
   ExecStart=/usr/bin/java -jar -Xdebug /opt/censer/google-ai/google-ai.jar ${JAVA_OPTS} Restart=on-abort
   User=censer
   Group=censer
   StandardOutput=syslog
   StandardError=syslog
   SyslogIdentifier=google-ai
   
   [Install]
   WantedBy=multi-user.target

6. Create the file /etc/sysconfig/censhare-google-ai with the following contents:
   JAVA_OPTS="–Dlog4j2.formatMsgNoLookups=true"

7. Restart the systemd service: 

   CODE

   systemctl daemon-reload 
   systemctl restart censhare.google-ai

8. Verify that the command-line parameter took effect with the following command:

   CODE

   ps aux | grep [g]oogle-ai

9. The result should show:

   CODE

   –Dlog4j2.formatMsgNoLookups=true

Social Media

1. Login to the server where the Cloud Gateway package is installed.
2. Edit the file /usr/lib/systemd/system/censhare.social-media.service:
3. Under WorkingDirectory, add the line: EnvironmentFile=-/etc/sysconfig/censhare-social-media
4. In the line ExecStart, append ${JAVA_OPTS}

5. The file should look like this: 

   CODE

   [Unit]
   Description=censhare springboot service for Social-Media.
   After=network-online.target
   
   [Service]
   Type=simple
   WorkingDirectory=/opt/censer/social-media
   EnvironmentFile=-/etc/sysconfig/censhare-social-media
   ExecStart=/usr/bin/java -jar /opt/censer/social-media/social-media.jar ${JAVA_OPTS}
   Restart=on-abort
   User=censer
   Group=censer
   StandardOutput=syslog
   StandardError=syslog
   SyslogIdentifier=social-media
   
   [Install]
   WantedBy=multi-user.target

6. Create the file /etc/sysconfig/censhare-social-media with the following contents:
   JAVA_OPTS="–Dlog4j2.formatMsgNoLookups=true"

7. Restart the systemd service with the following command: 

   CODE

   systemctl daemon-reload
   systemctl restart censhare.social-media

8. Verify that the command-line parameter took effect with the following command:

   CODE

   ps aux | grep [s]ocial-media

    The result should show: 

   CODE

   –Dlog4j2.formatMsgNoLookups=true