Log4j Vulnerability - Important Note to Performance Engineers
Tags: performance, webperf, tutorial, testing
Published: 2021-12-17 16:40:02

<!-- wp:paragraph -->
<p>The Internet went crazy last week. If you are an avid user of Tech Twitter, you would have known about the Log4j fiasco. Within a few hours, Log4j vulnerability made headlines on popular news outlets, Twitter, LinkedIn, major organizations' internal forums, Slack channels and more. This blog post is all about Log4j vulnerability for performance engineers about how to mitigate the attack.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>What is Apache Log4j Vulnerability CVE-2021-44228?</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>I am not a security expert. But I closely follow the security news on Twitter and feeds. CVE-2021-44228 is about remote code execution via JNDI lookup. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Apache Log4j is a popular logging framework for Java applications, websites, enterprises, consumer apps and more. Developers log information about security and performance for debugging, audit, and analysis. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>By sending the JNDI with LDAP, it is possible to extract or operate the remote server or local machine, if the app is using Log4j 2.0-beta9 to 2.14.1. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>There are numerous articles, videos, repos are available to deep-dive into this CVE. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This article targets performance engineers to help out with how to mitigate this vulnerability for the testing tools we are using. </p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":8945,"sizeSlug":"large","linkDestination":"media"} -->
<div class="wp-block-image"><figure class="aligncenter size-large"><a href="https://qainsights.com/wp-content/uploads/2021/12/Log4j-Vulnerability-Important-Note-to-Performance-Engineers.jpeg"><img src="https://qainsights.com/wp-content/uploads/2021/12/Log4j-Vulnerability-Important-Note-to-Performance-Engineers-1024x1024.jpeg" alt="Log4j Vulnerability - Important Note to Performance Engineers" class="wp-image-8945"/></a><figcaption>Log4j Vulnerability - Important Note to Performance Engineers</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:heading -->
<h2>Apache JMeter</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The latest version of JMeter 5.4.1 uses Log4j 2.13.3 which is affected by CVE-2021-44228.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>There are a couple of options available to mitigate the risk. But it is recommended to follow the Apache Log4j guidelines which are mentioned <a href="https://logging.apache.org/log4j/2.x/security.html#CVE-2021-44228" target="_blank" rel="noreferrer noopener">here</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>CVE-2021-44228 solves the problem partially. CVE-2021-45046 prevents attacks by mitigating attackers various patterns. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality <strong>by default</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>My recommendation is to update the Log4j jars of JMeter to 2.16.0 completely.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Go to JMETER_HOME\lib, delete all the log4j* files. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Download the Log4j zip file from <a href="https://logging.apache.org/log4j/2.x/download.html" target="_blank" rel="noreferrer noopener">Log4j website</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Extract it and copy the below files and paste it into JMETER_HOME\lib folder.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>log4j-1.2-api-2.16.0.jar
log4j-api-2.16.0.jar
log4j-core-2.16.0.jar
log4j-slf4j-impl-2.16.0.jar</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>JMeter 5.4.2 will be released soon with the bumped up version of Log4j. I will update my post, once it is released.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>UPDATE: <a href="https://qainsights.com/whats-new-in-apache-jmeter-5-4-2/" target="_blank" rel="noreferrer noopener">JMeter 5.4.2 has been released</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Tricentis NeoLoad</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Tricentis has released NeoLoad 8.0 with Log4j 2.15.0.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Grafana k6</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Grafana's k6 <a href="https://k6.io/blog/k6-products-not-impacted-by-cve-2021-44228/" target="_blank" rel="noreferrer noopener">doesn't use Log4j</a>. You are good to go. </p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>MicroFocus LoadRunner and Silk Performer</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>MicroFocus LoadRunner family is impacted by Log4j vulnerability. Please <a href="https://portal.microfocus.com/s/article/KM000003046?language=en_US" target="_blank" rel="noreferrer noopener">follow this link</a> to mitigate the risk.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Here is the bulletin link for <a href="https://microfocus.my.salesforce.com/sfc/p/#1t000000vhDP/a/8e000000c7fR/JrOxnycbJxIXDpzlzCCfBOy6pqqRcPD_cu.ySvH5Vc8" target="_blank" rel="noreferrer noopener">Silk Performer</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Gatling</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><a href="https://gatling.io/2021/12/log4shell-why-is-gatling-unaffected/" target="_blank" rel="noreferrer noopener">Gatling uses</a> logback logging library. If you are using Gatling, you are not affected.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>RedLine 13</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>RedLine13 itself doesn't use Log4j framework. But once JMeter 5.4.2 is out, it will be available on the RedLine13 platform.</p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>EggPlant Performance</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>If you are using <a href="https://blog.eggplantsoftware.com/apache-log4j-2-security-vulnerability" target="_blank" rel="noreferrer noopener">EggPlant Performance</a>, you are NOT affected by the Log4j vulnerability. </p>
<!-- /wp:paragraph -->

<!-- wp:heading -->
<h2>Conclusion</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>It is recommended to update the Log4j libraries with 2.16.0 ASAP. I will keep posting this blog post, if I get any new information. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Log4j developers have been working tirelessly to fix the issues for the past 1 week. A big salute to them from <a href="https://qainsights.com" target="_blank" rel="noreferrer noopener">QAInsights</a>.</p>
<!-- /wp:paragraph -->