# FS Crawler 2.4 on Apache Log4j2 Remote Code Execution (RCE) Vulnerability **URL:** \ **Category:** Elasticsearch\ **Created:** [December 13, 2021, 12:43pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649 "2021-12-13T12:43:37Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [December 13, 2021, 12:43pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/1 "2021-12-13T12:43:37Z")
Hi David, **recently we have received about Apache Log4j2 Remote Code Execution (RCE) Vulnerability.** > [@Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476?ultron=log4js-exploit&blade=announcement&hulk=email&mkt_tok=ODEzLU1BTS0zOTIAAAGBUB_sfudTGaiSLi0n0Xb8VSe8jm5yy6ISVR2kC1r6hEpgbOrzH6XGrIzLhvVW3JMr-yeJlxtLw9ADJ1emBs4PoxpVIAmCsLa0X7jWo8Zf6a9rSOji): > > Subject: Apache Log4j2 Vulnerability - CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 - ESA-2021-31 ​​Note - We will update this announcement with new details as they emerge from our analysis. Please check back periodically. Update Log Dec 16, 2021 - 04:20 UTC - Update Summary: ECK 1.9 released which automatically adds the JVM option to impacted Elasticsearch clusters managed by ECK. Dec 17, 2021 - 23:50 UTC - Update latest release of APM Java Agent to 1.28.2. Statement of pl… I am using FS Crawler 2.4 version along with ELK 6.8.14, we planned to do remediation plan for log4j in ELK. We would like to know, if _we need to what steps we need to do remediation plan for log4j in FS Crawler_. Please share your suggestions. Thanks in advance, Joseph ---
**Author:** ![Gianluigi\_Sellitto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gianluigi_sellitto/32/98822_2.png) [@Gianluigi\_Sellitto](https://discuss.elastic.co/u/Gianluigi_Sellitto)\ **Post date:** [December 13, 2021, 1:09pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/2 "2021-12-13T13:09:44Z")
Interested ... Any remediation at this time? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 13, 2021, 3:05pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/3 "2021-12-13T15:05:03Z")
I will work on a new version soonish. In the meantime, I recommend changing the shell script which starts FSCrawler. For version 2.4, and for unix users, I'd add line 44 of `bin/fscrawler`, the following lines: ```auto JAVA_OPTS="$JAVA_OPTS -Dlog4j2.formatMsgNoLookups=true" ``` For version 2.4, and for windows users, I'd add line 27 of `bin\fscrawler.bat`: ```auto set JAVA_OPTS=%JAVA_OPTS% -Dlog4j2.formatMsgNoLookups=true ``` And restart FSCrawler. This applies as well to FSCrawler 2.7 but the line number is different 45 for Unix and 33 for Windows. ---
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [December 13, 2021, 3:35pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/4 "2021-12-13T15:35:07Z")
Thanks a lot David. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 14, 2021, 6:32am UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/5 "2021-12-14T06:32:11Z")
FYI FSCrawler 2.8 has been released. > [@\[ANNOUNCEMENT\] - FSCrawler 2.8 released](https://discuss.elastic.co/t/announcement-fscrawler-2-8-released/291748): > > The FSCrawler team is pleased to announce the FSCrawler 2.8 release! FSCrawler FS Crawler offers a simple way to index binary files into Elasticsearch. Usage Download [FSCrawler 2.8](https://repo1.maven.org/maven2/fr/pilato/elasticsearch/crawler/fscrawler-es7/2.8/fscrawler-es7-2.8.zip): wget https://repo1.maven.org/maven2/fr/pilato/elasticsearch/crawler/fscrawler-es7/2.8/fscrawler-es7-2.8.zip Start FS crawler with: bin/fscrawler job\_name FS crawler will read a local file (default to ~/.fscrawler/{job\_name}/\_settings.json). If the file does not exist, FS crawler will propose to create your fi… ---
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [December 14, 2021, 6:06pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/6 "2021-12-14T18:06:39Z")
Hi David, One more doubt on this. Could you please share your comments/suggestions. Actually FS Crawler 2.4 is using Log4J 2.8.1 version. As per our security team says 'JAVA\_OPTS="$JAVA\_OPTS -Dlog4j2.formatMsgNoLookups=true"' not valid/applicable for the Log4J versions with version less than V 2.10. Thank You, Joseph ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 14, 2021, 6:53pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/7 "2021-12-14T18:53:37Z")
Ha right! So I guess you need to do this: > For releases from 2.0-beta9 to 2.10.0, the mitigation is to remove the `JndiLookup` class from the classpath: `zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class` ---
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [December 15, 2021, 3:27pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/8 "2021-12-15T15:27:27Z")
Thank You David. ---
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [January 6, 2022, 8:02am UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/9 "2022-01-06T08:02:26Z")
Hi David, Now, we have LOG4J 2.17. Could You please suggest, if we need to use this version into FS Crawler 2.4 Version, what action we need to take in our end. Thanks. ---
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [January 7, 2022, 8:55am UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/10 "2022-01-07T08:55:07Z")
Hi David, Could You please share your suggestion for my above Query. Thank You, Joseph ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 10, 2022, 2:51pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/11 "2022-01-10T14:51:16Z")
> [@joseph-l.amalraj](#): > > Could You please suggest, if we need to use this version into FS Crawler 2.4 Version, what action we need to take in our end. I have no idea. May be try to upgrade manually the dependencies of this version and rebuild a new release? ---
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [January 10, 2022, 5:27pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/12 "2022-01-10T17:27:45Z")
Ok Thanks David. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 10, 2022, 7:33pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/13 "2022-01-10T19:33:52Z")
FYI I just released FSCrawler 2.9 ---
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [January 28, 2022, 5:16pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/14 "2022-01-28T17:16:56Z")
Sure.. Thanks David. I have downloaded FS Crawler 2.9 to use with ELK 7.16. ---
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [January 28, 2022, 5:19pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/15 "2022-01-28T17:19:34Z")
Hi David, Could You please share your comments.. One more query like while installing FS Crawler 2.9, Can we update the log4j-_-2.17.2 in the lib folder as we get latest of log4j?. Currently, log4j-_-2.17.1 bundled with FS Crawler 2.9. Thanks, Joseph ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 28, 2022, 6:02pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/16 "2022-01-28T18:02:32Z")
I guess so. Not sure what are the other dependencies that changed as well if any. ---
**Author:** ![joseph-l.amalraj](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Post date:** [January 28, 2022, 6:14pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/17 "2022-01-28T18:14:21Z")
Fine, Thanks David. we will check that. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 25, 2022, 6:15pm UTC](https://discuss.elastic.co/t/fs-crawler-2-4-on-apache-log4j2-remote-code-execution-rce-vulnerability/291649/18 "2022-02-25T18:15:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.