WAF enables message lookup in Log4j2 misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_192
Category - Subcategory	Public Exposure - Ingress Controls
Provider	AWS
Severity	HIGH
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Using a vulnerable version of Apache Log4j library might enable attackers to exploit a Lookup mechanism that supports making requests using special syntax in a format string which can potentially lead to a risky code execution, data leakage and more. Set your Web Application Firewall (WAF) to prevent executing such mechanism using the rule definition below. Learn more around https://nvd.nist.gov/vuln/detail/CVE-2021-44228[CVE-2021-44228]

How to Fix

Resource: AWS::WAFv2::WebACL [source,go]

Pass: Type: AWS::WAFv2::WebACL Properties: ...

Rules:

• Name: AWS-AWSManagedRulesKnownBadInputsRuleSet Priority: 1 Statement: ManagedRuleGroupStatement: VendorName: AWS Name: AWSManagedRulesKnownBadInputsRuleSet OverrideAction: None: {} ...

---