Search code examples
log4jlog4js-node

Is Log4JS npm package vulnerable to CVE-2021-44228 Log4J vulnerability


As the title says. Looked online for a clear answer but can't find an answer anywhere as most of them just link to Log4J.


Solution

  • The answer is simple: Log4JS and Log4J share only a similar name and API. The codebases are entirely different (and written in different languages). The vulnerability of Log4J does not apply obviously to Log4JS.

    This kind of vulnerability could not even be easily implemented in JavaScript. Java's vulnerability is based on JNDI lookups, which usually are used to retrieve simple configuration data. However they also allow to retrieve serialized Java objects and new classes (cf. Oracle's documentation).

    The JavaScript equivalent of this vulnerability would be a formatter that replaces:

    log.info('${jndi:some JS code}');
    

    with

    log.info(eval(some JS code));