NetX Log4j Security (CVE-2021-44228) Updates

All SaaS sites were patched for the Log4j vulnerability on Friday, December 10th. NetX is continuing to investigate and implement additional remediation steps as they become available, including subsequent security updates from Log4j. We appreciate your understanding if we need to perform further maintenance on your site in the coming weeks and will provide as much notification as possible of any scheduled downtime.

If you have not already done so, please follow the remediation steps listed below.

Step 1: Back up all NetX Components and Data

Before performing any maintenance, NetX always recommends backing up your environments. But in this case, NetX also recommends that you take this opportunity to have your IT staff verify that all backup regimes are operating properly.

Step 2: Patch NetX

Download NetX version 9.16.11 and upgrade NetX 

or:

Upgrade the logging library manually (only available with NetX version 9):

1. Download the latest version of log4j from the Apache Foundation here: https://logging.apache.org/log4j/2.x/download.html. We recommend using the apache-log4j-2.17.1-bin.zip. Please make sure you follow the instructions to verify the validity of the downloaded archive before deploying it in your environments.
2. The following is a list of the affected jars and their path locations — [netx root] is the location of your NetX installation):
   
   [netx root]/webapps/ROOT/WEB-INF/lib/log4j-1.2-api-2.8.1.jar
   [netx root]/webapps/ROOT/WEB-INF/lib/log4j-api-2.8.1.jar
   [netx root]/webapps/ROOT/WEB-INF/lib/log4j-core-2.8.1.jar
   [netx root]/webapps/ROOT/WEB-INF/lib/log4j-jul-2.8.1.jar
   
   While unpatched NetX instances bundled version 2.8.1, we recommend scanning this directory for any matches of “log4j*”; if you find other versions (other than the patched 2.17.1 version), please contact NetX support for further instructions.
   
   
3. Stop the NetX service.
4. Remove each of the jars listed above and replace them with the updated 2.17.1 version:
   
   Remove
   [netx root]/webapps/ROOT/WEB-INF/lib/log4j-1.2-api-2.8.1.jar
   Add
   [netx root]/webapps/ROOT/WEB-INF/lib/log4j-1.2.api-2.17.1.jar
   
   
5. Perform this operation for each jar listed above.
6. Restart the NetX service.
7. Repeat all these steps for every deployed instance of NetX.

Step 3: Patch Solr

1. The following is a list of the affected jars and their path locations — [solr root] is the location of your Solr installation:
   
   [solr root]/solr/contrib/prometheus-exporter/lib/log4j-core-2.11.0.jar
   [solr root]/solr/contrib/prometheus-exporter/lib/log4j-slf4j-impl-2.11.0.jar
   [solr root]/solr/contrib/prometheus-exporter/lib/log4j-api-2.11.0.jar
   [solr root]/solr/server/lib/ext/log4j-core-2.11.0.jar
   [solr root]/solr/server/lib/ext/log4j-slf4j-impl-2.11.0.jar
   [solr root]/solr/server/lib/ext/log4j-api-2.11.0.jar
   [solr root]/solr/server/lib/ext/log4j-1.2-api-2.11.0.jar
   
   While the unpatched NetX instances bundled version of Solr 7.7.3 which includes Log4j version 2.11.0, we recommend scanning these directories for any matches of “log4j*”; if you find other versions (other than the patched 2.17.1 version), please contact NetX support for further instructions.
   
   
2. Stop the Solr service.
3. Remove each of the jars listed above and replace them with the updated 2.16.0 version:
   
   Remove
   [solr root]/solr/server/lib/ext/log4j-core-2.11.0.jar
   Add
   [solr root]/solr/server/lib/ext/log4j-core-2.17.1.jar
   
   
4. Perform this operation for each jar listed above.
5. Restart the Solr service.

Step 4: Remove Possible Old Version of Solr

Older installations of NetX may still contain an unused installation of Solr.  Please check if any of the following paths exist (and are not the location of the Solr 7.7.3 server installation)

[netx root]/solr
[netx root]/webapps/solr
[netx root]/webapps/solr.war
[netx root]/work/Catalina/localhost/solr

If you see one or more of these paths, please perform the following steps:

1. Stop the NetX service.
2. Remove each of the paths listed above, and all files under the paths that are directories.
3. Restart the NetX service
4. Repeat all these steps for every deployed instance of NetX.

Step 5: Turn off MediaRich (if applicable)

If you have purchased MediaRich and use it in conjunction with NetX, NetX recommends disabling MediaRich until Equilibrium can provide a patch. NetX will follow up with customers of MediaRich once we get a course of action from the vendor.

Step 6: Scan Intrusion

NetX highly recommends having industry-standard intrusion detection software installed. 

Step 7: Avoid Bringing Back Old Log4J Versions

We recommend that you review all processes for managing your NetX instance(s). For example, assuming you have backups, restoring those backups without re-running all these steps could reimplement the Log4j vulnerability. Carefully consider all IT processes — especially Disaster Recovery operations — to avoid bringing back a vulnerability in the future. 

Step 8: Read and Follow CISA Guidelines

CISA has put out an excellent high-level doc for guidance on handling security incidents, particularly relevant as we go into the holidays:

https://www.cisa.gov/sites/default/files/publications/CISA_INSIGHTS-Preparing_For_and_Mitigating_Potential_Cyber_Threats-508C.pdf