CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

https://github.com/irgoncalves/f5-waf-quick-patch-cve-2021-44228

Associated Vulnerability

Title:Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints (CVE-2021-44228)
Description:Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Description

This tool creates a custom signature set on F5 WAF and apply to policies in blocking mode

Readme

# f5-waf-quick-patch-CVE-2021-44228
F5 Networks Advanced WAF/ASM Quick Patch CVE 2021-44228.

# Overview

This tool connects to a BIG-IP device and creates a custom signature set called CVE-2021-4428 and apply it to all policies in blocking mode. It also enforces all signatures and apply the changes. This was tested on BIG-IP ASM v15.x but I believe it should work for v13.x/v14.x/v16.x.

WARNING: this procedure might increase CPU and memory on control plane usage while it is running.

# How it Works

The tool leverages BIG-IP iControl REST API to create the custom signature set as well to performs necessary changes to all policies.

# Installation

pip3 install -r requirements.txt

## Prerequisites

Python 3.7+

Libraries in requirements.txt

The host machine needs to have connection to the BIG-IP management interface.

# How to Use

```
usage: f5-waf-quick-view.py [-h] device

positional arguments:
  device      IP adrresses of the target BIG-IP devices separated by line

optional arguments:
  -h, --help  show this help message and exit

```

File Snapshot


 [4.0K]  /data/pocs/8a1935b0198a59f376887b3f2731fcf93535cc74
├── [  13]  bigip.txt
├── [6.1K]  f5-waf-quick-patch-cve-2021-44228.py
├── [1.0K]  README.md
└── [  33]  requirements.txt

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!