How to avoid Log4j vulnerability in your Magento
Tags: security, magento, elasticsearch
Published: 2021-12-16 22:19:17

---
title: How to avoid Log4j vulnerability in your Magento
published: true
description: Learn what Log4j is, how to verify it and how to avoid this attack on your Adobe Commerce and Magento OpenSource. Before start going deep into it, these are the next emergency steps to avoid this issue.
tags: security, magento, elasticsearch
canonical_url: https://www.linkedin.com/pulse/how-avoid-log4j-your-magento-rafael-corr%25C3%25AAa-gomes
cover_image: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y13j28a7o5mlcr4c4jhr.png
---

Learn what Log4j is, how to verify it and how to avoid this attack on your Adobe Commerce and Magento OpenSource. Before start going deep into it, these are the next emergency steps to avoid this issue.

Add a [custom VCL](https://fiddle.fastlydemo.net/fiddle/049ae446) rule in your Fastly or Varnish.
Upgrade your ElasticSearch to the new version (Dec 13, 2021).
Run the audit tool mentioned in this article.

## What’s Log4j?

It’s a Java framework used by developers to keep records of activity within an application. Although, the hacker has been using it to exploit the flaw is strategically sends a malicious code string that eventually gets logged by Log4j version 2.0 or higher ([CVE-2021-44228](https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce)). The exploit lets an attacker load arbitrary Java code on a server, allowing them to take control.

## Magento Log4j

When you have Adobe Commerce installation the most possible software that might bring this vulnerability is ElasticSearch. If you have it in a different server or container you might check that server first.

If you have hosting support, for example, MageMojo, Ecritel, WebScale or Platform.sh, contact them as soon as possible. Having your own server on AWS or Digital Ocean, make sure you have your server has updated packages. The main updated package that you need to have is ElasticSearch.

In order to keep your server updated you should keep your Magento updated too, the last stable version of Magento is compatible with the lasted version of the server packages too, like PHP, ElasticSearch, etc. If you don’t have your upgrade planned, [let’s create one for you](https://rafaelcg.com/contact).

## ElasticSearch

If you use ElasticSearch 5, 6 or 7 you need to update it to use the version launched today (Dec 13, 2021). To mitigate attacks during the time you’re upgrading your ElasticSearch, you need to set the [JVM](https://www.elastic.co/guide/en/elasticsearch/reference/7.16/advanced-configuration.html#set-jvm-options) option below.

```
-Dlog4j2.formatMsgNoLookups=true
```

## Fastly

For now, Fastly has not yet deployed a general WAF rule, if you want to mitigate against this please deploy [this VCL](https://fiddle.fastlydemo.net/fiddle/049ae446) on staging and test then deploy to prod. It’s going to block possible communication via a new Log4j script.

![Magento 2 Fastly Log4j](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n5b48jz4ny6ws0ic8r01.png)
 

## How to detect it?

The easiest way to detect it is to run this script below, it’s going to verify if you have the vulnerability. In case you have that vulnerability in your server, you can run the second tool called [Grype](https://github.com/anchore/grype), it’s going to find any possible threat using this vulnerability.

### Automated Check

```
wget https://raw.githubusercontent.com/rubo77/log4j_checker_beta/main/log4j_checker_beta.sh -q -O - |bash
```

###  Or Manual check

Find files with suspect names

```
locate log4j|grep -v log4js;
```

Find the lib log4j if it’s installed

```
dpkg -l|grep log4j;
```

Check if Java it’s installed, if it’s check folders jar/war/ear

```
which java
```

Thank you for checking it, and remember to keep your system updated.