Apache RCE Vulnerabilities: Log4j, Spring, Struts CVEs, Patches, and POC

Vulnerability Overview 1. Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228) - Description: The JNDI feature in Apache Log4j 2 contains a remote code execution vulnerability. - Affected Scope: All applications using Log4j 2. - Remediation: Upgrade to Log4j 2.17.1 or higher. 2. Spring Framework Remote Code Execution Vulnerability (CVE-2022-22963) - Description: SpEL expression parsing in Spring Framework contains a remote code execution vulnerability. - Affected Scope: Applications using Spring Framework 5.3.0 to 5.3.17 and 5.2.0 to 5.2.19. - Remediation: Upgrade to Spring Framework 5.3.18 or higher. 3. Log4Shell Vulnerability (CVE-2021-44228) - Description: The JNDI feature in Log4j 2 contains a remote code execution vulnerability. - Affected Scope: All applications using Log4j 2. - Remediation: Upgrade to Log4j 2.17.1 or higher. 4. Apache Struts Remote Code Execution Vulnerability (CVE-2020-17530) - Description: OGNL expression parsing in Apache Struts 2 contains a remote code execution vulnerability. - Affected Scope: Applications using Struts 2.0.0 to 2.5.25. - Remediation: Upgrade to Struts 2.5.26 or higher. 5. Apache Solr Remote Code Execution Vulnerability (CVE-2019-17558) - Description: The Velocity template engine in Apache Solr contains a remote code execution vulnerability. - Affected Scope: Applications using Solr 8.0.0 to 8.6.1. - Remediation: Upgrade to Solr 8.6.2 or higher. 6. Apache Tomcat Remote Code Execution Vulnerability (CVE-2020-1938) - Description: The AJP protocol in Apache Tomcat contains a remote code execution vulnerability. - Affected Scope: Applications using Tomcat 8.5.50 to 8.5.51 and 9.0.30 to 9.0.31. - Remediation: Upgrade to Tomcat 8.5.52 or higher. 7. Apache Kafka Remote Code Execution Vulnerability (CVE-2020-14181) - Description: The Schema Registry in Apache Kafka contains a remote code execution vulnerability. - Affected Scope: Applications using Kafka 2.4.0 to 2.4.1. - Remediation: Upgrade to Kafka 2.4.2 or higher. 8. Apache Flink Remote Code Execution Vulnerability (CVE-2020-17510) - Description: The JobManager in Apache Flink contains a remote code execution vulnerability. - Affected Scope: Applications using Flink 1.10.0 to 1.10.1. - Remediation: Upgrade to Flink 1.10.2 or higher. 9. Apache Spark Remote Code Execution Vulnerability (CVE-2020-13933) - Description: The Thrift Server in Apache Spark contains a remote code execution vulnerability. - Affected Scope: Applications using Spark 2.4.0 to 2.4.5. - Remediation: Upgrade to Spark 2.4.6 or higher. 10. Apache Hadoop Remote Code Execution Vulnerability (CVE-2020-13933) - Description: The YARN ResourceManager in Apache Hadoop contains a remote code execution vulnerability. - Affected Scope: Applications using Hadoop 3.1.0 to 3.1.2. - Remediation: Upgrade to Hadoop 3.1.3 or higher. POC Code or Exploit Code Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228) Spring Framework Remote Code Execution Vulnerability (CVE-2022-22963) Apache Struts Remote Code Execution Vulnerability (CVE-2020-17530) Apache Solr Remote Code Execution Vulnerability (CVE-2019-17558) Apache Tomcat Remote Code Execution Vulnerability (CVE-2020-1938) Apache Kafka Remote Code Execution Vulnerability (CVE-2020-14181) Apache Flink Remote Code Execution Vulnerability (CVE-2020-17510) Apache Spark Remote Code Execution Vulnerability (CVE-2020-13933) Apache Hadoop Remote Code Execution Vulnerability (CVE-2020-13933) Remediation Summary Apache Log4j: Upgrade to Log4j 2.17.1 or higher. Spring Framework: Upgrade to Spring Framework 5.3.18 or higher. Apache Struts: Upgrade to Struts 2.5.26 or higher. Apache Solr: Upgrade to Solr 8.6.2 or higher. Apache Tomcat: Upgrade to Tomcat 8.5.52 or higher. Apache Kafka: Upgrade to Kafka 2.4.2 or higher. Apache Flink: Upgrade to Flink 1.10.2 or higher. Apache Spark: Upgrade to Spark 2.4.6 or higher. Apache Hadoop: Upgrade to Hadoop 3.1.3 or higher.

Goal Reached Thanks to every supporter — we hit 100%!

Apache RCE Vulnerabilities: Log4j, Spring, Struts CVEs, Patches, and POC