The version of log4j installed on the remote host is prior to 1.2.17-16.12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1562 advisory.

    It was found that when using remote logging with log4j socket server the log4j server would deserialize     any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log     event that, during deserialization, would execute arbitrary code in the context of the logger application.
    (CVE-2017-5645)

    A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of     untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a     deserialization gadget. (CVE-2019-17571)

    A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is     vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the     server if the deployed application is configured to use JMSAppender and to the attacker's JNDI LDAP     endpoint. (CVE-2021-4104)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux AMI : log4j (ALAS-2022-1562)

critical Nessus Plugin ID 156871

Version 1.6

Version 1.5

Version 1.4

Version 1.6 Dec 11, 2024, 10:15 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412112215
Version 1.5 Nov 21, 2023, 1:14 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202311210114
Version 1.4 Feb 20, 2023, 11:57 PM Regenerated based on advisory update Plugin Feed: 202302202357