关联漏洞
描述
Springboot web application accepts a name get parameter and logs its value to log4j2. Vulnerable to CVE-2021-44228.
介绍
# log4shellwithlog4j2_13_3
Springboot web application accepts a name get parameter and logs its value to log4j2. Vulnerable to CVE-2021-44228.
# build the Springboot vulnerable application with
mvn clean install
# run the Springboot application with the k2 agent with
java --add-modules java.sql -javaagent:/opt/k2-ic/K2-JavaAgent-1.0.0-jar-with-dependencies.jar -jar target/demoLog4Shellwithlog4j2ver2_13_3-0.0.1-SNAPSHOT.jar
文件快照
[4.0K] /data/pocs/42cc291b77f963b5e3ab341f08ca9225696ab413
├── [1.2K] HELP.md
├── [4.0K] main
│ ├── [ 66] config
│ ├── [ 73] description
│ ├── [ 23] HEAD
│ ├── [4.0K] hooks
│ │ ├── [ 478] applypatch-msg.sample
│ │ ├── [ 896] commit-msg.sample
│ │ ├── [3.0K] fsmonitor-watchman.sample
│ │ ├── [ 189] post-update.sample
│ │ ├── [ 424] pre-applypatch.sample
│ │ ├── [1.6K] pre-commit.sample
│ │ ├── [ 416] pre-merge-commit.sample
│ │ ├── [1.5K] prepare-commit-msg.sample
│ │ ├── [1.3K] pre-push.sample
│ │ ├── [4.8K] pre-rebase.sample
│ │ ├── [ 544] pre-receive.sample
│ │ └── [3.5K] update.sample
│ └── [4.0K] info
│ └── [ 240] exclude
├── [9.8K] mvnw
├── [6.5K] mvnw.cmd
├── [2.4K] pom.xml
├── [ 430] README.md
├── [4.0K] src
│ ├── [4.0K] main
│ │ ├── [4.0K] java
│ │ │ └── [4.0K] com
│ │ │ └── [4.0K] example
│ │ │ └── [4.0K] demowithlog4j2
│ │ │ ├── [ 341] Demolog4j2ver2_16Application.java
│ │ │ └── [ 784] GreetingController.java
│ │ └── [4.0K] resources
│ │ ├── [ 18] application.properties
│ │ └── [4.0K] templates
│ │ └── [ 275] greeting.html
│ └── [4.0K] test
│ └── [4.0K] java
│ └── [4.0K] com
│ └── [4.0K] example
│ └── [4.0K] demowithlog4j2
│ └── [ 226] Demowithlog4j2ApplicationTests.java
└── [4.0K] target
├── [4.0K] classes
│ ├── [ 18] application.properties
│ ├── [4.0K] com
│ │ └── [4.0K] example
│ │ └── [4.0K] demowithlog4j2
│ │ ├── [ 792] Demolog4j2ver2_16Application.class
│ │ └── [1.9K] GreetingController.class
│ └── [4.0K] templates
│ └── [ 275] greeting.html
├── [4.0K] maven-archiver
│ └── [ 87] pom.properties
├── [4.0K] maven-status
│ └── [4.0K] maven-compiler-plugin
│ ├── [4.0K] compile
│ │ └── [4.0K] default-compile
│ │ ├── [ 114] createdFiles.lst
│ │ └── [ 236] inputFiles.lst
│ └── [4.0K] testCompile
│ └── [4.0K] default-testCompile
│ ├── [ 64] createdFiles.lst
│ └── [ 125] inputFiles.lst
├── [4.0K] surefire-reports
│ ├── [ 363] com.example.demowithlog4j2.Demowithlog4j2ApplicationTests.txt
│ └── [ 17K] TEST-com.example.demowithlog4j2.Demowithlog4j2ApplicationTests.xml
└── [4.0K] test-classes
└── [4.0K] com
└── [4.0K] example
└── [4.0K] demowithlog4j2
└── [ 581] Demowithlog4j2ApplicationTests.class
34 directories, 38 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。