A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). (From an email CloudFlare sent to users)
Is a site susceptible to the Log4J exploit if all parameters taken from the request are sanitized? The most "lenient" form of sanitization on the site removes everything but the alphabet, numerals and punctuation such as hyphen, commas etc.
int param = SecurityIssues.StringToInt(request.getParameter("param")); String itemType = SecurityIssues.StringToAlphaNumeric(request.getParameter("itemType")); String message= SecurityIssues.StringToAlphaNumericPlusPunctuationStr(request.getParameter("message"));
As it happens the site has other levels of protection (e.g CloudFlare WAF) - and I know that all libraries should be updated. I am just asking whether sanitizing by itself would theoretically provide sufficient protection.
From Steffen Ullrich's answer to How can the Log4Shell exploit affect an end user? it appears that the exploit can only affect information emanating from untrusted sources, and so if all information taken from the request is sanitized then there should be no problem, but I wanted to check that this was correct and that my level of sanitization is sufficient.