CVE-2024-12798: Logback-Core RCE Vulnerability

CVE-2024-12798 Overview

CVE-2024-12798 is an Arbitrary Code Execution (ACE) vulnerability affecting QOS.CH logback-core, a widely used logging framework in Java applications. The vulnerability exists in the JaninoEventEvaluator extension and allows attackers to execute arbitrary code by compromising an existing logback configuration file or by injecting a malicious environment variable before program execution.

The attack requires existing privileges on the target system. A successful exploitation can occur through two primary vectors: gaining write access to an existing logback configuration file, or injecting a malicious environment variable that points to a malicious configuration file. Both scenarios require the attacker to have some level of pre-existing access to the system.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code on affected Java applications, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Affected Products

• QOS.CH logback-core versions 0.1 to 1.3.14
• QOS.CH logback-core versions 1.4.0 to 1.5.12
• Java applications utilizing vulnerable logback-core versions

Discovery Timeline

• 2024-12-19 - CVE-2024-12798 published to NVD
• 2025-01-03 - Last updated in NVD database

Technical Details for CVE-2024-12798

Vulnerability Analysis

This vulnerability is classified as CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement), commonly known as Expression Language Injection. The JaninoEventEvaluator component in logback-core provides functionality to evaluate Java expressions within logging configurations, which can be abused when an attacker controls the configuration content.

The attack surface is local, requiring the attacker to either have write access to configuration files or the ability to manipulate environment variables before the Java application starts. This pre-requisite reduces the likelihood of opportunistic exploitation but increases risk in environments where configuration management is weak or where attackers have already established a foothold.

Root Cause

The root cause lies in the JaninoEventEvaluator extension's handling of expressions within logback configuration files. When processing configuration data, the evaluator compiles and executes Java expressions without adequate restrictions, allowing malicious code execution when the configuration source is compromised. The trust placed in configuration files as a legitimate source of instructions creates an avenue for code execution when file integrity is not maintained.

Attack Vector

The vulnerability requires local access and operates through configuration file manipulation. An attacker with write access to a logback configuration file (typically logback.xml or logback-groovy.xml) can inject malicious Java code that will be executed when the application loads or reloads its logging configuration.

Alternatively, attackers can set environment variables such as LOGBACK_CONFIGURATION_FILE to point to a malicious configuration file under their control. This method requires the ability to modify the application's execution environment before startup.

The exploitation chain involves:

1. Gaining write access to configuration files or environment variable control
2. Injecting malicious Java expressions into the JaninoEventEvaluator configuration
3. Triggering configuration loading or reloading by the target application
4. Achieving arbitrary code execution within the application's security context

Detection Methods for CVE-2024-12798

Indicators of Compromise

• Unexpected modifications to logback configuration files (logback.xml, logback-groovy.xml, or logback.groovy)
• Suspicious environment variables pointing to non-standard configuration file locations
• Unusual JaninoEventEvaluator entries in configuration files containing complex Java expressions
• Application logs showing unexpected code execution or compilation errors during configuration loading

Detection Strategies

• Monitor file integrity of logback configuration files using file integrity monitoring (FIM) solutions
• Audit environment variable changes, particularly LOGBACK_CONFIGURATION_FILE and related configuration variables
• Implement application-level logging to detect configuration reload events from unexpected sources
• Scan configuration files for suspicious patterns such as Runtime.getRuntime().exec() or reflection-based method calls

Monitoring Recommendations

• Enable file access auditing on directories containing logback configuration files
• Configure SentinelOne to monitor for process execution chains originating from Java applications that appear anomalous
• Implement change management alerting for logging configuration modifications
• Review application startup scripts for unauthorized environment variable injections

How to Mitigate CVE-2024-12798

Immediate Actions Required

• Upgrade logback-core to version 1.3.15 or later for the 1.3.x branch
• Upgrade logback-core to version 1.5.13 or later for the 1.5.x branch
• Audit existing logback configuration files for malicious or suspicious content
• Restrict write permissions on logback configuration files to authorized administrators only
• Review environment variable settings in application deployment configurations

Patch Information

QOS.CH has released patched versions addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• For logback-core 1.3.x series: Upgrade to version 1.3.15 or later (Logback Release Notes 1.3.15)
• For logback-core 1.5.x series: Upgrade to version 1.5.13 or later (Logback Release Notes 1.5.13)

Dependency management tools such as Maven or Gradle should be updated to pull the fixed versions. Organizations using transitive dependencies should verify that all dependent libraries are also updated.

Workarounds

• Implement strict file system permissions limiting configuration file write access to root or application service accounts only
• Disable or remove the JaninoEventEvaluator component if not required by your logging configuration
• Validate and sanitize environment variables before application startup using secure deployment scripts
• Use configuration file signing or integrity verification to detect unauthorized modifications
• Deploy applications in containerized environments with read-only file systems for configuration directories

# Configuration example: Restrict permissions on logback configuration files
chmod 640 /path/to/application/logback.xml
chown root:appgroup /path/to/application/logback.xml

# Verify no suspicious JaninoEventEvaluator entries exist
grep -r "JaninoEventEvaluator" /path/to/application/*.xml

# Check for suspicious environment variables
env | grep -i logback