CVE-2025-54813
📋 TL;DR
This vulnerability in Apache Log4cxx's JSONLayout allows attackers to inject non-printable characters into log messages, which aren't properly escaped. This can corrupt JSON log output and disrupt downstream log processing systems. It affects all applications using Log4cxx versions before 1.5.0 with JSONLayout enabled.
💻 Affected Systems
- Apache Log4cxx
📦 What is this software?
Log4cxx by Apache
⚠️ Risk & Real-World Impact
Worst Case
Log corruption leads to log analysis system failures, data loss in monitoring pipelines, or denial of service for applications relying on log processing.
Likely Case
Disrupted log parsing in SIEM systems, monitoring tools, or log aggregators causing gaps in visibility and alerting.
If Mitigated
Minimal impact if logs aren't consumed by JSON parsers or if proper input validation exists before logging.
🎯 Exploit Status
Exploitation requires ability to control log message content, typically through application inputs. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.0
Vendor Advisory: https://logging.apache.org/security.html#CVE-2025-54813
Restart Required: Yes
Instructions:
1. Download Log4cxx 1.5.0 from Apache website. 2. Replace existing Log4cxx library files. 3. Recompile applications if statically linked. 4. Restart all services using Log4cxx.
🔧 Temporary Workarounds
Switch to PatternLayout
allTemporarily use PatternLayout instead of JSONLayout for logging output
Modify log4cxx.xml or configuration to replace <layout class="org.apache.log4j.json.JSONLayout"> with <layout class="org.apache.log4j.PatternLayout">
Input Validation Filter
allAdd custom filter to sanitize log messages before JSONLayout processing
Implement custom filter class that escapes non-printable characters before passing to logger
🧯 If You Can't Patch
- Implement application-level input validation to sanitize all user inputs before logging
- Deploy log processing middleware that sanitizes JSON output before reaching downstream systems
🔍 How to Verify
Check if Vulnerable:
Check if application uses Log4cxx with JSONLayout and version is below 1.5.0Check Version:
Check library files or use: strings liblog4cxx.so | grep -i versionVerify Fix Applied:
Verify Log4cxx version is 1.5.0 or higher and test logging with non-printable characters to confirm proper escaping📡 Detection & Monitoring
Log Indicators:
- Malformed JSON in log files
- Log parsing errors in downstream systems
- Unexpected control characters in JSON logs
Network Indicators:
- Increased error rates in log processing systems
SIEM Query:
source="*log4cxx*" AND (message="*JSONParseError*" OR message="*malformed JSON*")