CVE-2021-44228 - Logstahs - ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath

[prajyodh]

Hi

I was checking on impact of CVE-2021-44228 on ELK stack and came across the link

Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31

Subject: Apache Log4j2 Vulnerability - CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 - ESA-2021-31 ​​Note - We will update this announcement with new details as they emerge from our analysis. Please check back periodically. Update Log Dec 16, 2021 - 04:20 UTC - Update Summary: ECK 1.9 released which automatically adds the JVM option to impacted Elasticsearch clusters managed by ECK. Dec 17, 2021 - 23:50 UTC - Update latest release of APM Java Agent to 1.28.2. Statement of pl…

When i tried the solution mentioned for logstash to remove the JNDI Class

zip -q -d <LOGSTASH_HOME>/logstash-core/lib/jars/log4j-core-2.13.3.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

I took Back up of existing jar. Copied log4j-core-2.13.3.jar to my home , tried above command in my home directory and copied back the updated jar back to lib/jars/.

When I start logstash now i see the below Error in logs.
I reverted back to the old existing jar and still the error continues.
Any inputs are appreciated.

    021/12/14 06:28:27 - logstash started.
    warning: --1.9 ignored
    ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath. Using SimpleLogger to log to the console...
    NameError: missing class name (`org.apache.logging.log4j.core.LoggerContext')
      method_missing at org/jruby/javasupport/JavaPackage.java:252
              <main> at /opt/app/logstash/logstash-core/lib/logstash/api/modules/logging.rb:18
             require at org/jruby/RubyKernel.java:974
             require at /opt/app/logstash/vendor/bundle/jruby/2.5.0/gems/polyglot-0.3.5/lib/polyglot.rb:65
              <main> at /opt/app/logstash/logstash-core/lib/logstash/api/rack_app.rb:25
             require at org/jruby/RubyKernel.java:974
             require at /opt/app/logstash/vendor/bundle/jruby/2.5.0/gems/polyglot-0.3.5/lib/polyglot.rb:65
              <main> at /opt/app/logstash/logstash-core/lib/logstash/webserver.rb:18
             require at org/jruby/RubyKernel.java:974
             require at /opt/app/logstash/vendor/bundle/jruby/2.5.0/gems/polyglot-0.3.5/lib/polyglot.rb:65
              <main> at /opt/app/logstash/logstash-core/lib/logstash/agent.rb:23
             require at org/jruby/RubyKernel.java:974
              <main> at /opt/app/logstash/logstash-core/lib/logstash/runner.rb:44
             require at org/jruby/RubyKernel.java:974
              <main> at /opt/app/logstash/lib/bootstrap/environment.rb:87

[sandeepkanabar]

Make sure you change the ownership of the file to logstash:logstash or whatever it was before you made the changes.

[prajyodh]

The ownership is the same
logstash:logstash (before and after changes)

[sandeepkanabar]

Elastic has come out with a removal tool and an excellent article on Logstash - Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation