CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Description

Script - Workaround instructions to address CVE-2021-44228 in vCenter Server 

Readme

# vCenter Server Workaround instructions CVE-2021-44228
 Workaround instructions to address CVE-2021-44228 in vCenter Server 

VMware vCenter log4j workaround
This is the workaround VMware vCenter log4j vulnerability CVE-2021-44228 processs put together as a single script

VMware have released a python script linked on the KB article (works Much better :-)

If you don't like quick and dirty..
Apply workarounds and verify

cve-workaround
Run verification only

cve-workaround -v
Rollback - very basic, copies the .bak files over the patched files, restarts the services, and prints status messages.
cve-workaround -rollback
PSC Client Service for 6.5 - thank you to Power-Wagon on reddit for verifying
cve-workaround -sprayandpray65

Simple steps:
SSH to vCenter
Type shell to enter shell mode
Paste entire contents of script
Type cve, hit tab, enter
And you're done.

The Process:
Automatically detects the version and required steps
Backs up existing files to .bak files
Applies the workarounds recommended by VMware
Skips any steps that are already applied
Reports status as it goes
Provides a summary at the end - verification is more accurate / granular than the KB steps

File Snapshot

 [4.0K]  /data/pocs/3c1b11fbf1ffb4c4520e22faf275fd0db9beeda0
├── [1.2K]  README.md
└── [ 12K]  run-cve-patch.sh

0 directories, 2 files

Remarks