{"id":7496,"date":"2022-04-22T20:09:30","date_gmt":"2022-04-22T20:09:30","guid":{"rendered":"https:\/\/gridinsoft.com\/blogs\/?p=7496"},"modified":"2022-04-22T20:12:14","modified_gmt":"2022-04-22T20:12:14","slug":"amazon-patch-for-log4shell","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/amazon-patch-for-log4shell\/","title":{"rendered":"Amazon Patch for Log4Shell allowed privilege escalation"},"content":{"rendered":"<h4>Palo Alto Networks warns that a patch released by Amazon to protect AWS from high-profile issues in Apache Log4j, including the Log4Shell vulnerability, poses a threat to users.<\/h4>\n<p>The patch can be used to escape the container and escalate privileges, allowing an attacker to take control of the underlying host.<\/p>\n<p>Let me remind you that in December last year, shortly after cybersecurity researchers alarmed about problems in <strong>Apache Log4j<\/strong>, <a href=\"https:\/\/aws.amazon.com\/blogs\/opensource\/hotpatch-for-apache-log4j\/\" rel=\"noopener nofollow\" target=\"_blank\">Amazon released emergency patches<\/a> that fix bugs in various environments, including servers, Kubernetes, Elastic Container Service (ECS) and Fargate. The purpose of hotpatches was to quickly fix vulnerabilities while system administrators transited their applications and services to a secure version of <strong>Log4j<\/strong>.<\/p>\n<p>Let me also remind you that soon after the discovery of vulnerabilities, <a href=\"\/blogs\/attacks-on-the-log4shell-vulnerability\/\">real attacks on the <strong>Log4Shell<\/strong> were recorded<\/a>. Moreover, the experts also found out that the <a href=\"\/blogs\/aquatic-panda-group-exploits-log4shell\/\">Chinese hack group <strong>Aquatic Panda<\/strong> exploits Log4Shell to hack educational institutions<\/a>.<\/p>\n<p>However, as <strong>Palo Alto Networks<\/strong> has now found out, the patches were not very successful and could, among other things, lead to the capture of other containers and client applications on the host.<\/p>\n<div class=\"su-quote su-quote-style-default su-quote-has-cite\"><div class=\"su-quote-inner su-u-clearfix su-u-trim\">In addition to containers, unprivileged processes can use a patch to elevate privileges and execute code as root.<span class=\"su-quote-cite\"><a href=\"https:\/\/unit42.paloaltonetworks.com\/aws-log4shell-hot-patch-vulnerabilities\/\" target=\"_blank\" rel=\"nofollow noopener\">experts say.<\/a><\/span><\/div><\/div>\n<p><iframe loading=\"lazy\" width=\"640\" height=\"360\" src=\"https:\/\/www.youtube.com\/embed\/jK9a7IoMu5I\" title=\"YouTube video player\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe><\/p>\n<p>The experts showed a video demonstrating an attack on the supply chain with the malicious container image  and usage of an earlier patch. Similarly, compromised containers can be used to &#8220;escape&#8221; and take over the underlying host. <strong>Palo Alto Networks<\/strong> decided not to share details about this exploit yet, so that attackers could not use it.<\/p>\n<div class=\"su-quote su-quote-style-default su-quote-has-cite\"><div class=\"su-quote-inner su-u-clearfix su-u-trim\">Any process executing a binary named java &#8211; inside or outside the container &#8211; is considered a candidate for a hotpatch. There, the malicious container could include a malicious binary named java to trick the installed hotpatch into calling it with elevated privileges.<span class=\"su-quote-cite\">the analysts say.<\/span><\/div><\/div>\n<p>In the next step, elevated privileges could be used by a malicious java process to escape the container and take full control of the compromised server.<\/p>\n<p>Users <a href=\"https:\/\/aws.amazon.com\/security\/security-bulletins\/AWS-2022-006\/\" rel=\"noopener nofollow\" target=\"_blank\">are advised to update to the corrected version of the hotpatch<\/a> as soon as possible in order to prevent exploitation of related bugs.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Palo Alto Networks warns that a patch released by Amazon to protect AWS from high-profile issues in Apache Log4j, including the Log4Shell vulnerability, poses a threat to users. The patch can be used to escape the container and escalate privileges, allowing an attacker to take control of the underlying host. Let me remind you that [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":7509,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","footnotes":""},"categories":[15],"tags":[202,315,450,438,183],"class_list":{"0":"post-7496","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security-news","8":"tag-amazon","9":"tag-exploit","10":"tag-log4j","11":"tag-log4shell","12":"tag-palo-alto-networks"},"featured_image_src":"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2022\/04\/Log4Shell.jpg","author_info":{"display_name":"Vladimir Krasnogolovy","author_link":"https:\/\/gridinsoft.com\/blogs\/author\/krasnogolovy\/"},"_links":{"self":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/7496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/comments?post=7496"}],"version-history":[{"count":2,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/7496\/revisions"}],"predecessor-version":[{"id":7510,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/7496\/revisions\/7510"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media\/7509"}],"wp:attachment":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media?parent=7496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/categories?post=7496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/tags?post=7496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}