Impact of CVE-2021-44228 on NSX Advanced Load Balancer (Avi)
As mentioned in VMware KB VMware Response to CVE-2021-44228: Apache Log4j Remote Code Execution (87068), VMware NSX Advanced Load Balancer (Avi) is not vulnerable to CVE-2021-44228.
This document provides additional guidance regarding the CVE and its applicability to NSX Advanced Load Balancer (Avi).
NSX Advanced Load Balancer (Avi) comprises of two components: The Control Plane and the Data Plane
Avi Data Plane
The Avi data plane is NOT vulnerable to attacks detailed in the CVE.
Avi Control Plane
The Avi Control Plane provides customers with a point of management, and can be accessed via the UI, CLI, or the REST API. The Avi Control Plane runs in a secure environment, and is isolated from end-user traffic.
The Avi Controller is NOT vulnerable to the attacks detailed in the CVE.
Additional Information on Avi Control Plane
The Avi Controller uses Elasticsearch to index application logs from Virtual Service traffic.
Our analysis confirms that attackers cannot exploit the vulnerability to their advantage, as data is stored in Elasticsearch but not logged using the vulnerable framework.The logging framework is not made available to the end user directly, and we do not see a case where a malicious lookup can be made to the Controller, given the architecture and specific, contained use of Elasticsearch
While we are confident that NSX Advanced Load Balancer (Avi) is not vulnerable to the CVE, out of an abundance of caution and in-line with security best practices, an optional patch to disable the JndiLookup Class will be released.
Patch Details
Patches have been released and made available for the following releases:
In addition, future releases, starting from the following, will have the JndiLookup Class disabled:
Change log: