[CVE-2021-44228] Apache Log4j2 RCE

[dawoon_lee]

Hello.

Our customer is running a Ruckus SmartZone (sz-100) controller.
The version of the controller is 5.1.1.0.598.

The customer asked if the SmartZone has the following this security vulnerabilities.

** Vulnerability: [CVE-2021-44228] Apache Log4j2 RCE

Thank you for your valuable answers to the above questions.

[diego_garcia_de]

thanks @allan_grohe Thats good to know. Especially for this forum where everyone can read about it.

[diego_garcia_de]

Hello everyone concerned,

We've seen some recommendations to block outgoing connections from smartzone as a possible mitigation / protection (since the blocked outgoing connection would prevent the malicious ldap download from occurring). 

Keep in mind that a port other than the standard LDAP could be included in the exploit URL so its not enough to just block outgoing LDAP traffic.

Is there any way that ruckus can provide a list of "expected" IPs that the smartzone would connect to in normal operation?

Of course, any proxied radius connections, ftp server for logging or backup, etc would be entirely up to me, the administrator, to add.

But I have now added a block-and-log rule and I'm seeing outgoing connections to akamai from smartzone, in particular to IPs 23.205.105.175 and 23.205.105.155

[bjarne_goldau]

I just want to add, that you can check if there were attacks by searching the "web-critical" log for "jndi:ldap".
Does anybody know if the control interface is vulnerable too?

[Vineet_nejwala]

@bjarne_goldau

Management interface would be the most likely vulnerable since a user can input a specific string from UI/Public API to trigger this vulnerability but IMHO any way that an attacker can input a specific string into logger directly or indirectly via any interface will affect SZ .  On the fix (ksp patch) we are currently completing testing cycle to make sure there is no regression and once completed it would be out.

Best Regards

Vineet

[bjarne_goldau]

Hi Vineet, Management interface is vulnerable, i tried that myself. I am asking about the control interface where the accesspoint connect to. Do you have any information on that?