Incomplete Log4Shell Patch Leaves Systems Open to Critical Log4j Flaw
CVE-2021-45046 is a critical Apache Log4j vulnerability that bypasses the initial Log4Shell fix in version 2.15.0. Attackers actively exploit this flaw in non-default configurations to achieve remote code execution.
CVE-2021-45046 is a critical vulnerability in Apache Log4j that serves as an incomplete fix for the original Log4Shell flaw. The initial patch in Log4j version 2.15.0 fails to fully secure the JNDI lookup exploitation vector in certain non-default configurations. CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog, which confirms active exploitation in the wild by malicious actors.
This flaw impacts Apache Log4j versions 2.0 through 2.15.0 and affects numerous major software products, including Intel OneAPI, Siemens industrial systems, and distributions like Debian and Fedora. Attackers exploit this issue when applications use non-default Pattern Layouts that contain Context Lookups or Thread Context Map patterns such as %X, %mdc, or $${ctx:loginId}. By controlling Thread Context Map input data, threat actors bypass the initial protections and trigger malicious JNDI connections.
The consequences of this exploit are severe, enabling remote code execution through JNDI injection and local code execution in all affected environments. The underlying mechanics rely on the same JNDI injection technique as the original Log4Shell vulnerability, but they specifically target edge cases that the first patch leaves unaddressed. Organizations must upgrade beyond version 2.15.0 to fully mitigate this critical risk and secure their logging infrastructure.