Apache Log4j 2.21.0 < 2.25.4 Rfc5424Layout Log Injection (CVE-2026-34478)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(306548);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/27");

  script_cve_id("CVE-2026-34478");
  script_xref(name:"IAVA", value:"2026-A-0324");

  script_name(english:"Apache Log4j 2.21.0 < 2.25.4 Rfc5424Layout Log Injection (CVE-2026-34478)");

  script_set_attribute(attribute:"synopsis", value:
"A logging library installed on the remote host is affected by a log injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Apache Log4j on the remote host is 2.21.0 through 2.25.3. It is, therefore, affected by a
vulnerability:

  - The Rfc5424Layout is vulnerable to log injection via CRLF sequences due to undocumented renames of
    security-relevant configuration attributes. The newLineEscape attribute was silently renamed, disabling
    newline escaping for TCP framing. The useTlsMessageFormat attribute was also renamed, causing TLS framing
    users to be silently downgraded to unframed TCP. (CVE-2026-34478)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  script_set_attribute(attribute:"see_also", value:"https://logging.apache.org/security.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Log4j version 2.25.4 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-34478");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:log4j");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_log4j_nix_installed.nbin", "apache_log4j_win_installed.nbin");
  script_require_keys("installed_sw/Apache Log4j");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Apache Log4j', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '2.21.0', 'fixed_version': '2.25.4'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);