CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Description

CVE-2021-44228

Readme

# CVE-2021-44228

An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.

This script will help to detect log4j exploit from the running process. It helps to find if any system is exploitable or not, without actully exploiting the code.

It will try to fetch process those using java and check for the log4j-core component.

Note: The script is written on bash, and using two packages(zip, unzip) which is required to run the script.

<br>

### References:

MITRE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228

NIST: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

Affected and unaffected products of Apache: https://blogs.apache.org/security/entry/cve-2021-44228

Release History of log4j: https://logging.apache.org/log4j/2.x/changes-report.html

Detailed video by Java Brains: https://www.youtube.com/watch?v=uyq8yxWO1ls

File Snapshot

 [4.0K]  /data/pocs/4203c94835e00846d30dc33e570d2e30cffa3a00
├── [1.4K]  detect_log4j_exploit
├── [1.0K]  LICENSE
└── [ 951]  README.md

0 directories, 3 files

Remarks