T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2021-44228/ground-truth.yaml

@@ -0,0 +1,28 @@
+cve: CVE-2021-44228
+alias: Log4Shell
+cwe_primary: CWE-917
+cwe_acceptable: [CWE-917, CWE-94, CWE-20, CWE-502, CWE-74]
+target_file: source.java
+vuln_lines: [34, 35, 36]
+severity: critical
+vuln_class: expression_injection
+exploit_pattern_regex: '\$\{jndi:(ldap|rmi|dns)://'
+must_mention_any:
+  - jndi
+  - lookup
+  - substitut
+  - ${
+  - attacker controlled
+  - remote class
+  - expression injection
+  - code execution
+points: 30
+notes: |
+  Vulnerability: format() invokes substitutor.replace(event, formatted) on the
+  message body itself when it contains `${`. The substitutor resolves nested
+  lookups including `${jndi:...}` which fetches and deserialises a remote class.
+  Any logged user-controlled string becomes an RCE primitive.
+  Hunter MUST identify:
+    1. Recursive substitution of message body contents
+    2. JNDI lookup is reachable through the substitutor
+    3. Lack of lookups-disabled guard (`noLookups` is dead-code)