CVE-2019-17571

What it actually does

The SocketServer class in Log4j 1.2 accepts untrusted network input and performs deserialization without validation, enabling remote code execution when a suitable gadget chain is present.

Why it matters to the business

Attackers can gain full control of affected systems over the network, leading to data theft, service disruption, or further compromise, with high urgency for any deployments still using the vulnerable component despite its age.

How an attack unfolds

An attacker connects to the exposed SocketServer port and transmits a crafted serialized Java object that, upon deserialization, triggers a gadget chain to execute arbitrary commands; no authentication is required.

How to fix it

Upgrade swagger-api/swagger-ui to the fixed commit 278dc05c886ce9d5d91860d56d9b57f3ab53ad5b or later; replace any direct or transitive use of Log4j 1.2.17 or earlier with a supported version that disables or removes the vulnerable SocketServer functionality.

How to confirm the fix worked

Confirm the running version of Log4j is newer than 1.2.17 and that SocketServer is not instantiated or bound to network interfaces; review dependency trees and scan for the vulnerable class files.

Typical attack path

1. Identify hosts running Log4j 1.2 with SocketServer enabled and listening on a network port
2. Craft a malicious serialized payload using a known deserialization gadget chain
3. Send the payload over the network to the SocketServer listener
4. Trigger deserialization to achieve remote code execution and establish persistence or exfiltrate data

How to detect it

Review application logs and network traffic for connections to SocketServer ports, inspect Java process command lines for Log4j 1.2 references, and search for serialized object patterns or unexpected class loading during log processing.

What your security team should do

• Immediately audit all environments for Log4j 1.2 usage and prioritize upgrade to the specified fixed commit or newer release
• Disable or firewall off any SocketServer listeners until upgrades are complete
• Implement network segmentation and monitoring for unexpected deserialization activity on logging ports