29 lines
934 B
YAML
29 lines
934 B
YAML
cve: CVE-2021-44228
|
|
alias: Log4Shell
|
|
cwe_primary: CWE-917
|
|
cwe_acceptable: [CWE-917, CWE-94, CWE-20, CWE-502, CWE-74]
|
|
target_file: source.java
|
|
vuln_lines: [34, 35, 36]
|
|
severity: critical
|
|
vuln_class: expression_injection
|
|
exploit_pattern_regex: '\$\{jndi:(ldap|rmi|dns)://'
|
|
must_mention_any:
|
|
- jndi
|
|
- lookup
|
|
- substitut
|
|
- ${
|
|
- attacker controlled
|
|
- remote class
|
|
- expression injection
|
|
- code execution
|
|
points: 30
|
|
notes: |
|
|
Vulnerability: format() invokes substitutor.replace(event, formatted) on the
|
|
message body itself when it contains `${`. The substitutor resolves nested
|
|
lookups including `${jndi:...}` which fetches and deserialises a remote class.
|
|
Any logged user-controlled string becomes an RCE primitive.
|
|
Hunter MUST identify:
|
|
1. Recursive substitution of message body contents
|
|
2. JNDI lookup is reachable through the substitutor
|
|
3. Lack of lookups-disabled guard (`noLookups` is dead-code)
|