Log4Shell: the flaw hiding in a line of text

The story

Log4j is free software that keeps records, called logs, for programs written in the Java language. It is used inside a huge range of products, from business software to websites to the game Minecraft.

In December 2021, a flaw in it became public, soon named Log4Shell. If a program used Log4j to record a piece of text, and that text contained a certain kind of instruction, Log4j would follow it and could run code from anywhere on the internet. Attackers only had to get their text logged: in a chat message, a username, or a website form.

It was easy to use, and the flaw had been there since 2013. It received the highest possible severity rating. Attacks began almost immediately.

Why it mattered

The hardest part was knowing where Log4j was. Most businesses did not use it directly; it was buried inside products they had bought. Over the following weeks, IT teams worked through every system asking vendors whether they were affected.

The lesson today

Many products contain other products. When a flaw like this appears, the response depends on knowing what you run, who supplies it and how to reach them, then getting updates applied quickly.