POC详情: f805f538cee398ccb5a453dabe6e47c186db74a7

来源
关联漏洞
标题: Apache Log4j 代码问题漏洞 (CVE-2021-44228)
描述:Apache Log4j是美国阿帕奇(Apache)基金会的一款基于Java的开源日志记录工具。 Apache Log4J 存在代码问题漏洞,攻击者可设计一个数据请求发送给使用 Apache Log4j工具的服务器,当该请求被打印成日志时就会触发远程代码执行。
描述
jee web project with sanitised log4shell (CVE-2021-44228) vulnerability
介绍
## log4shell false positive

This is a simple web project with a sanitised log4shell vulnerability. For an unsanitised version, see [https://github.com/scabench/l4j-tp1/](https://github.com/scabench/l4j-tp1/).
The project defines a simple `scabench.HelloWorldService` get service returning a plain text string `hello world`.
The service does not expect parameters, and if parameters are encountered, an error 
is logged. 

The vulnerable dependency is [org.apache.logging.log4j:log4j-core:2.14.1](https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core/2.14.1), the vulnerability is [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228). 

### Sanitisation

The project uses an [agent build by Amazon](https://github.com/corretto/hotpatch-for-apache-log4j2) when *log4shell* emerged and no patch was available.
The agent will disable the vulnerable class `org.apache.logging.log4j.core.lookup.JndiLookup`. 

Using the agent is enforced by installing (aka attaching) the agent dynamically when `scabench.HelloWorldService` is loaded (in the static block of the class), 
if this fails, the application crashes. This requires that the JVM enables agent self-attachment.


### Running the Application

1. enable JVM agent self attachment: `export MAVEN_OPTS="-Djdk.attach.allowAttachSelf=true"`
2. start the embedded web server: `mvn jetty:run`
3. start the included the ldap server: `java -jar dodgy-ldap-server.jar` (the vulnerable copde will download Java code from this server)
4. point the browser to `http://localhost:8080/`, this site contains a pre-populated form with a malicious payload `${jndi:ldap://127.0.0.1/exe}`
5. submit this form
6. this will *NOT* create the file `foo` on the server (as the [un-sanitised version]((https://github.com/scabench/l4j-tp1/)) does)


Note that when running the application, the following line appears on the console:

`Transforming org/apache/logging/log4j/core/lookup/JndiLookup `.

### Demonstrating the Sanitisation using a Test

This requires unix or macos. It is easy to port this project to windows.
A unit test is provided to demonstrate the vulnerability, the setup is the same used in 
[https://github.com/scabench/l4j-tp1/](https://github.com/scabench/l4j-tp1/). Due to santitisation,
the test now *fails*. 

### Running Software Composition Analyses

There are several sh scripts to run different analyses, result resports can be found in `scan-results`.

### Generating the SBOM

The `pom.xml` has a plugin to generate a [SBOM](https://www.cisa.gov/sbom) in [CycloneDX](https://cyclonedx.org/) format. 
To do this, run `mvn cyclonedx:makePackageBom`, the SBOM can be found in 
`target/` in `json` and `xml` format.

文件快照
 [4.0K]  /data/pocs/f805f538cee398ccb5a453dabe6e47c186db74a7
├── [ 11K]  LICENSE
├── [136K]  Log4jHotPatch.jar
├── [4.4K]  pom.xml
├── [2.6K]  README.md
├── [ 452]  run-owasp.sh
├── [ 261]  run-snyk.sh
├── [4.0K]  scan-results
│   ├── [4.0K]  dependency-check
│   │   └── [156K]  dependency-check-report.json
│   └── [4.0K]  snyk
│       └── [ 27K]  snyk-report.json
└── [4.0K]  src
    ├── [4.0K]  main
    │   ├── [4.0K]  java
    │   │   └── [4.0K]  scabench
    │   │       └── [2.8K]  HelloWorldService.java
    │   └── [4.0K]  webapp
    │       └── [ 364]  index.html
    └── [4.0K]  test
        └── [4.0K]  java
            └── [4.0K]  scabench
                └── [1.9K]  Log4ShellTest.java

11 directories, 11 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
    3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。