CVE-2021-4104 Apache Log4j

Comments

Rule Name: file rule & deserial sys rule, Marshal RCE rule, Process rule and Deserial RCE rule, mitigated by set of File, Socket and Deserialization rules

• The fix https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126

Rule example

app("File read protect mod"):
    requires(version: ARMR/2.8)
    filesystem("Protect read access in specific directory"):
        read("/tmp/*")
        protect(message: "Unauthorized file read blocked", severity: 8)
    endfilesystem
endapp
app("myapp"):
    requires(version: ARMR/2.8)
    marshal("protect the app from remote-code-execution attack"):
        deserialize(java)
        rce()
        protect(message: "the logging message", severity: Low)
    endmarshal
endapp
app("Socket Client Bind Mod Multiple Rules"):
    requires(version: ARMR/2.8)
    socket("Socket bind protect all"):
        bind(client: "0.0.0.0:0")
        protect(message: "Socket rule protect 0.0.0.0:0", severity: High)
    endsocket
    socket("Socket bind allow specific"):
        bind(client: "127.0.0.1:5000")
        allow(message: "Socket rule allow 127.0.0.1:5000", severity: Medium)
    endsocket
endapp