CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

https://github.com/VinniMarcon/Log4j-Updater

Associated Vulnerability

Title:Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints (CVE-2021-44228)
Description:Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Description

Log4J Updater Bash Script to automate the framework update process on numerous machines and prevent the CVE-2021-44228

Readme

# Log4j Updater

With the inevitable need to update the famous Java framework called Log4j, numerous companies are needing to update Log4j on several computers at the same time, which takes time and cost, and that's where the **Log4j Updater** comes in.

`log4jupdater.sh` is a simple bash script with the aim of **automatically detecting the package manager to be used by the system and, if you have a log4j repository, update it and install the latest version possible, automating the process of updating it on multiple machines at once.**

## compatibility

The only package managers compatible with the script are `APT` and `YUM`.

The following links can be useful to check if log4j packages exist on famous linux systems and version used:

| System | Link |
|:------:|------|
| CentOS | [here](https://pkgs.org/download/log4j) |
| Debian | [here](https://packages.debian.org/search?keywords=liblog4j1.2-java&searchon=names&suite=stable&section=all) |
| Ubuntu | [here](https://packages.ubuntu.com/search?suite=all&searchon=names&keywords=liblog4j2-java) |   

## Safe versions

The script will attempt to update Log4j to the latest possible version supported by the package manager. The following versions below are considered safe against **CVE-2021-44228**:

- **1.X versions** are all safe
- **2.X versions** are only safe from 2.15.0 or above (>=2.15.0)

## Script Usage

```sh
bash log4jupdater.sh
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!