A vulnerability assessment has identified the presence of Log4j 1.2.17 within a legacy installation of Elasticsearch 2.4.

The Log4j library is included as a third-party dependency distributed with Elasticsearch 2.4 and is located within the application's library directory. As Log4j 1.x reached end of life many years ago, vulnerability scanners routinely identify all versions of the library as requiring review.

Although the finding is technically correct (the application does contain Log4j 1.2.17) it does not necessarily imply that the Elasticsearch installation is vulnerable to remote compromise. Most automated scanners identify the presence of the library by inspecting application files and do not determine whether vulnerable functionality is actually present or exploitable.

The most widely publicised Log4j vulnerability (CVE-2021-44228, commonly known as Log4Shell) affects Log4j 2.x and does not affect Log4j 1.2.17.

The Elasticsearch installation is therefore not susceptible to the Log4Shell remote code execution vulnerability.

Log4j 1.x has several published CVEs. The following are most commonly flagged and are assessed in the context of the Big Data Service deployment.

This vulnerability exploits the JMSSink appender, which can be used to trigger lookups against an LDAP service. The Big Data Service logging configuration does not use the JMSSink appender, and the deployment does not use any LDAP services. Exploiting this vulnerability would additionally require local modification of the logging configuration, which itself requires privileged access to the host machine.

Assessment: Not applicable to the standard Big Data Service configuration.

This vulnerability affects the JDBCAppender for logging to databases. The Big Data Service logging configuration only uses console and rolling file appenders; the JDBCAppender is not present in the configuration.

Assessment: Not applicable to the standard Big Data Service configuration.

The Apache Chainsaw log viewer tool is compiled into the log4j.jar distributed with the Big Data Service. The logging configuration does not include a Chainsaw appender and the tool is not invoked during normal operation.

If Chainsaw's presence is a concern, log4j.jar can be opened with 7-Zip or a compatible archive tool. The org/apache/log4j/chainsaw directory can be safely deleted from within the archive without affecting normal logging behaviour.

Assessment: Not applicable to the standard Big Data Service configuration. The Chainsaw directory can be removed from the JAR archive if required.

Beyond the specific assessments above, the affected Elasticsearch server is protected by several compensating controls:

• internal-only deployment;
• isolated network;
• no direct Internet exposure;
• access restricted to trusted internal systems;
• Windows operating system security controls;
• restricted administrative access.

Consequently, the practical risk presented by the bundled Log4j library is considered low despite the vulnerability scanner flagging the component.

Reload4j Replacement

Following the retirement of Log4j 1.x by the Apache Software Foundation, Reload4j was created to provide a maintained implementation that preserves API compatibility with existing applications while addressing security issues and maintenance defects. The project is maintained by QOS.CH, the organisation behind the widely used SLF4J and Logback logging frameworks. The project continues to receive maintenance releases, with version 1.2.26 published in December 2024. The maintainers state that, while no new functionality is planned, the project will continue to receive maintenance updates and security fixes.

Reload4j retains the original Log4j 1.2 package structure and public APIs, allowing many legacy Java applications to operate without source code changes.

1. Download and install the latest Reload4j assembly (v1.2.26 at time of writing) from https://repo1.maven.org/maven2/ch/qos/reload4j/reload4j/1.2.26/reload4j-1.2.26.jar.

2. Stop the Big Data Service

• Open Windows Services.
• Find “Intelligent Plant Big Data Service”.
• Right-click and select “Stop”.

3. Delete Log4j assembly

• Open file explorer.
• Navigate to %ProgramFiles%\Intelligent Plant\Big Data\es\lib
• Delete (or move) log4j-1.2.17.jar

4. Deploy Reload4j

• Open file explorer.
• Navigate to %ProgramFiles%\Intelligent Plant\Big Data\es\lib
• Deploy reload4j-1.2.26.jar

5. Restart the Big Data Service

• Open Windows Services.
• Find “Intelligent Plant Big Data Service”. Right-click and select “Start”.

Warning. This patch will be reset if software is re-installed/upgraded.

Should any issue be encountered:

1. Stop Elasticsearch.
2. Remove the replacement JAR.
3. Restore the original log4j-1.2.17.jar.
4. Restart Elasticsearch.