CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Description

Testing WAF protection against CVE-2021-44228 Log4Shell

Readme

Simple bash script to test your WAF or other devices against Log4Shell attack strings and various bypasses

Bypass tricks from: https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words

To run:
```
./cve-2021-44228.sh -t <URL of the target> -c <HTTP Status Code expected>
```

Or to use the defaults of https://127.0.0.1 and 403:
```
./cve-2021-44228.sh
```

For each test string, this will pass the string into a request to the target using various vectors such as:

* Headers: Using the `User-Agent` header
* URI: Appending the string to requested URI
* Cookies: As the data value of a Cookie
* Query String: As the value of a query string parameter
* POST Body Data: As the body data of a POST request


Example output:
```
Test String: ${jndi:}
-------------------------------------------------------------
HEADERS: curl -ksg -w "%{http_code}" https://127.0.0.1 -A '${jndi:}'
    403
URI: curl -ksg -w "%{http_code}" 'https://127.0.0.1/${jndi:}'
    403
Cookies: curl -ksg -w "%{http_code}" https://127.0.0.1 -b 'session=${jndi:}'
    403
Query String: curl -ksg -w "%{http_code}" 'https://127.0.0.1/something?session=${jndi:}'
    403
POST Data: curl -X POST -ksg -w "%{http_code}" https://127.0.0.1 -d '${jndi:}'
    403
```

File Snapshot

 [4.0K]  /data/pocs/dfffa29e4173bdefe7445ee901523824d156fd74
├── [5.1K]  cve-2021-44228.sh
└── [1.2K]  README.md

0 directories, 2 files

Remarks