Apache Log4j2 vulnerability
A possible exposure of Apache Log4j2 JNDI features to attacks via log messages and log message parameters requires immediate action for some censhare services. In this security update article, you find the necessary actions to fix any possible third-party vulnerability.
Affected censhare versions and services
The vulnerability affects Spring Boot applications with log4j 2.14.1 and lower. In censhare, this affects the Social Media service, Google Cloud AI service, Cloud Gateway and the Static Resource Server (SRS).
censhare version | service |
---|---|
censhare 2021.2 WP |
|
censhare 2021.1 | |
censhare 2020.3 | |
censhare 2020.2 |
Remarks
(1) These services are part of the Google Cloud AI and Social Media integrations of censhare. They are optional.
(2) These services are part of the RPM packages of censhare WP. They are required for censhare 2021.2 installation.
Required actions
As an immediate action to mitigate a possible vulnerability, on the Java Virtual Machince of the affected services, set argument –Dlog4j2.formatMsgNoLookups=True:
Cloud Gateway
- Login to the server where the Cloud Gateway package is installed.
- Edit the file /usr/lib/systemd/system/censhare.cloud-gateway.service:
- Under WorkingDirectory, add the line: EnvironmentFile=-/etc/sysconfig/censhare-cloud-gateway
- In the line ExecStart, append ${JAVA_OPTS}
The file should look like this:
CODE[Unit] Description=censhare springboot service for Cloud Gateway. After=network-online.target [Service] Type=simple WorkingDirectory=/opt/censer/cloud-gateway EnvironmentFile=-/etc/sysconfig/censhare-cloud-gateway ExecStart=/usr/bin/java -jar /opt/censer/cloud-gateway/cloud-gateway.jar ${JAVA_OPTS} Restart=on-abort User=censer Group=censer StandardOutput=syslog StandardError=syslog SyslogIdentifier=cloud-gateway [Install] WantedBy=multi-user.target
- Create the file /etc/sysconfig/censhare-cloud-gateway with the following contents:
JAVA_OPTS="–Dlog4j2.formatMsgNoLookups=true" Restart the systemd service:
CODEsystemctl daemon-reload systemctl restart censhare.cloud-gateway
Verify that the command-line parameter took effect with the following command:
CODEps aux | grep [c]loud-gateway
The result should look as follows:
CODEcenser <omitted> /usr/bin/java -jar /opt/censer/cloud-gateway/cloud-gateway.jar –Dlog4j2.formatMsgNoLookups=true
Static Resource Server
- Login to the server where the Static Resource Server package is installed.
- Edit the file /usr/lib/systemd/system/censhare.static-resource-server.service:
- Under WorkingDirectory, add the line: EnvironmentFile=-/etc/sysconfig/censhare-static-resource-server
- In the line ExecStart, append ${JAVA_OPTS}
The file should look like this:
CODE[Unit] Description=censhare springboot service for Static Resource Server. After=network-online.target [Service] Type=simple WorkingDirectory=/opt/censer/static-resource-server EnvironmentFile=-/etc/sysconfig/censhare-static-resource-server ExecStart=/usr/bin/java -jar /opt/censer/static-resource-server/static-resource-server.jar ${JAVA_OPTS} Restart=on-abort User=censer Group=censer StandardOutput=syslog StandardError=syslog SyslogIdentifier=static-resource-server [Install] WantedBy=multi-user.target
- Create the file /etc/sysconfig/censhare-static-resource-server with the following contents:
JAVA_OPTS="–Dlog4j2.formatMsgNoLookups=true" Restart the systemd service:
CODEsystemctl daemon-reload systemctl restart censhare.static-resource-server
Verify that the command-line parameter took effect with the following command:
CODEps aux | grep [s]tatic-resource-server
The result should look something like this:
CODEcenser <omitted> /usr/bin/java -jar /opt/censer/static-resource-server/static-resource-server.jar –Dlog4j2.formatMsgNoLookups=true
Google AI
- Login to the server where the Google AI integration package is installed.
- Edit the file /usr/lib/systemd/system/censhare.google-ai.service:
- Under WorkingDirectory, add the line: EnvironmentFile=-/etc/sysconfig/censhare-google-ai
- In the line ExecStart, append ${JAVA_OPTS}
The file should look like this:
CODE[Unit] Description=censhare springboot service for Google-AI. After=network-online.target [Service] Type=simple WorkingDirectory=/opt/censer/google-ai EnvironmentFile=-/etc/sysconfig/censhare-google-ai ExecStart=/usr/bin/java -jar -Xdebug /opt/censer/google-ai/google-ai.jar ${JAVA_OPTS} Restart=on-abort User=censer Group=censer StandardOutput=syslog StandardError=syslog SyslogIdentifier=google-ai [Install] WantedBy=multi-user.target
- Create the file /etc/sysconfig/censhare-google-ai with the following contents:
JAVA_OPTS="–Dlog4j2.formatMsgNoLookups=true" Restart the systemd service:
CODEsystemctl daemon-reload systemctl restart censhare.google-ai
Verify that the command-line parameter took effect with the following command:
CODEps aux | grep [g]oogle-ai
The result should show:
CODE–Dlog4j2.formatMsgNoLookups=true
Social Media
- Login to the server where the Cloud Gateway package is installed.
- Edit the file /usr/lib/systemd/system/censhare.social-media.service:
- Under WorkingDirectory, add the line: EnvironmentFile=-/etc/sysconfig/censhare-social-media
- In the line ExecStart, append ${JAVA_OPTS}
The file should look like this:
CODE[Unit] Description=censhare springboot service for Social-Media. After=network-online.target [Service] Type=simple WorkingDirectory=/opt/censer/social-media EnvironmentFile=-/etc/sysconfig/censhare-social-media ExecStart=/usr/bin/java -jar /opt/censer/social-media/social-media.jar ${JAVA_OPTS} Restart=on-abort User=censer Group=censer StandardOutput=syslog StandardError=syslog SyslogIdentifier=social-media [Install] WantedBy=multi-user.target
- Create the file /etc/sysconfig/censhare-social-media with the following contents:
JAVA_OPTS="–Dlog4j2.formatMsgNoLookups=true" Restart the systemd service with the following command:
CODEsystemctl daemon-reload systemctl restart censhare.social-media
Verify that the command-line parameter took effect with the following command:
CODEps aux | grep [s]ocial-media
The result should show:
CODE–Dlog4j2.formatMsgNoLookups=true