ACI / APIC Log4j Vulnerability

[tobycth3]

I see APIC listed on CVE-2021-44228 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd but little to no details confirming if ACI vulnerable. Does anyone have any information if the APICs do indeed leverage Log4j and any mitigation steps that could be put in place if it does?

[Leo Laohoo]

• Cisco Event Response: Apache Log4j Java Logging Library Security Incident
• Vulnerability in Apache Log4j Library Affecting Cisco Products

[Sergiu.Daniluk]

It is mentioned in the link you shared that APIC is not affected.

[Robert Burns]

APIC has now been affected via the Nexus Insights Base app (aka Nexus Insights Cloud Connector) app package which comes pre-installed.  No fix for this yet, but to avoid the vulnerability, please remove this app via App Center until you can upgrade the fabric to a patched version.  Tracking as CDET CSCwa47295.

Robert

[Network_Sarovani]

@Robert Burns How to check if this app is installed or disabled in APIC GUI ?

[Robert Burns]

You need to remove the App completely (there is no disable).  You can verify this from the CLI as well:

apic1# acidiag scheduler appstatus

Job App Type Status
---------------------------------------------------------------------------
Cisco_ApicVision-SystemService Cisco_ApicVision system running
Cisco_ApicVision-service-jobs Cisco_ApicVision service error
Cisco_ExternalSwitch-service-job Cisco_ExternalSwitch service error
Cisco_NIBASE-ClusterService Cisco_NIBASE service running <<<<<< (shows NI Base is running)
Cisco_NIBASE-SystemService Cisco_NIBASE system running <<<<<< (shows NI Base is installed)
bird_kafka-kafka bird_kafka system running
bird_zk-zk bird_zk system running
elastic-systemjob-medium elastic system running
elastic-systemjob-large elastic system running
elastic-systemjob-small elastic system running
intersightdc-systemjob-small intersightdc system running
//snip

Once NI Base has been deleted from App Center, it will not appear in the output above.

Robert

[Network_Sarovani]

Thank you  

[joezersk]

The NI Base App vulnerability has been fixed in 5.2(3g).  Release notes here.

Note, APIC itself it not affected by Log4J, just the NI Base app. It should also be made clear that in order to exploit the NI Base app, one first needs to authenticate to APIC.  I'd argue (my opinion only) that if the bad guys had authentication privs to your APIC, you have larger things to worry about!

Leaf and Spine firmware is not vulnerable to Log4j issues.  

[Robert Burns]

To close the loop, software versions which are patched in both our current long lived releases include 4.2(7r)+ and 5.2(3g)+.   If you are running these releases or later, its safe to re-enable the NI Base application once again. 
Thanks,

Robert