Enterprise Vulnerability Assessment: Prioritizing Log4Shell & Zerologon (NIST SP 800-115)

Executive Summary

This report details a credentialed vulnerability assessment conducted on a simulated hospital enterprise infrastructure following the NIST SP 800-115 guidelines. The primary goal was to identify, evaluate, and prioritize critical security flaws across core network services to prevent potential ransomware deployment and unauthorized domain takeover.

Assessment Methodology & Scope

Using credentialed vulnerability scanning, network devices, application servers, and Active Directory Domain Controllers were analyzed against known Common Vulnerabilities and Exposures (CVEs).

Focus areas included:

• Electronic Health Record (EHR) Application Servers
• Primary Domain Controllers (DC)
• External Perimeter Gateways

---

Critical Findings & Analysis

1. Log4Shell — Remote Code Execution (RCE)

• Target System: EHR Application Server
• CVE: CVE-2021-44228
• CVSSv3 Score: 10.0 (CRITICAL)
• Impact: Unauthenticated remote code execution allowing full control over the electronic health records database.
• Root Cause: Insecure JNDI lookup handling within the Apache Log4j library.

2. Zerologon — Privilege Escalation

• Target System: Primary Domain Controller
• CVE: CVE-2020-1472
• CVSSv3 Score: 10.0 (CRITICAL)
• Impact: Allows an attacker with local network access to instantly reset the Active Directory domain controller's machine account password, leading to complete domain compromise.
• Root Cause: Insecure cryptographic implementation in the Netlogon Remote Protocol (MS-NRPC).

---

Remediation Strategy & Mitigation Timeline

Priority	Target System	CVE	Risk Level	Recommended Action
P1 - Immediate	EHR App Server	CVE-2021-44228	Critical (10.0)	Patch Log4j to version 2.17.1+ or apply JVM flag.
P1 - Immediate	Primary DC	CVE-2020-1472	Critical (10.0)	Deploy Microsoft Security Update (KB4565349/KB4571687).

Temporary Mitigation Controls (Workarounds)

For immediate mitigation on the EHR Server prior to the full patch window deployment, the following Java Virtual Machine (JVM) parameter was applied:

bash
# Temporary JVM flag to disable JNDI lookups in Log4j 2.10 - 2.14.1
-Dlog4j2.formatMsgNoLookups=true