cve/2021/CVE-2021-44832.md

CVE-2021-44832

Description

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

POC

Reference

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html

Github

• https://github.com/ADP-Dynatrace/dt-appsec-powerup
• https://github.com/ARPSyndicate/cve-scores
• https://github.com/ARPSyndicate/cvemon
• https://github.com/Boupouchi/Log4j-Detector-PFA
• https://github.com/Chrisync/CVE-Scanner
• https://github.com/CycodeLabs/cycode-aws-live-stream
• https://github.com/DK26/local-secrets
• https://github.com/GluuFederation/Log4J
• https://github.com/HynekPetrak/log4shell-finder
• https://github.com/MaineK00n/vuls2
• https://github.com/Mattrobby/Log4J-Demo
• https://github.com/NaInSec/CVE-PoC-in-GitHub
• https://github.com/NiftyBank/java-app
• https://github.com/Pluralsight-SORCERI/log4j-resources
• https://github.com/Qualys/log4jscanwin
• https://github.com/Ryan2065/Log4ShellDetection
• https://github.com/SYRTI/POC_to_review
• https://github.com/ShadowPayload06/Internship-security-scan-
• https://github.com/WhooAmii/POC_to_review
• https://github.com/YoungBear/log4j2demo
• https://github.com/YunDingLab/fix_log4j2
• https://github.com/andalik/log4j-filescan
• https://github.com/aws/aws-msk-iam-auth
• https://github.com/bananaacaat/Log4j-Detector
• https://github.com/cckuailong/log4j_RCE_CVE-2021-44832
• https://github.com/chenghungpan/test_data
• https://github.com/christian-taillon/log4shell-hunting
• https://github.com/clouditor/clouditor
• https://github.com/dbzoo/log4j_scanner
• https://github.com/demonrvm/Log4ShellRemediation
• https://github.com/dinlaks/RunTime-Vulnerability-Prevention---RHACS-Demo
• https://github.com/domwood/kiwi-kafka
• https://github.com/dtact/divd-2021-00038--log4j-scanner
• https://github.com/gumimin/dependency-check-sample
• https://github.com/hbeooooooom/Log4shell_poc
• https://github.com/hillu/local-log4j-vuln-scanner
• https://github.com/hinat0y/Dataset1
• https://github.com/hinat0y/Dataset10
• https://github.com/hinat0y/Dataset11
• https://github.com/hinat0y/Dataset12
• https://github.com/hinat0y/Dataset2
• https://github.com/hinat0y/Dataset3
• https://github.com/hinat0y/Dataset4
• https://github.com/hinat0y/Dataset5
• https://github.com/hinat0y/Dataset6
• https://github.com/hinat0y/Dataset7
• https://github.com/hinat0y/Dataset8
• https://github.com/hinat0y/Dataset9
• https://github.com/jonelo/jacksum
• https://github.com/lgtux/find_log4j
• https://github.com/lhotari/pulsar-docker-images-patch-CVE-2021-44228
• https://github.com/logpresso/CVE-2021-44228-Scanner
• https://github.com/marklogic/marklogic-contentpump
• https://github.com/martinlau/dependency-check-issue
• https://github.com/mergebase/csv-compare
• https://github.com/mergebase/log4j-detector
• https://github.com/mosaic-hgw/jMeter
• https://github.com/n1f2c3/log4jScan_demo
• https://github.com/name/log4j
• https://github.com/name/log4j-scanner
• https://github.com/nlmaca/Wowza_Installers
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/palantir/log4j-sniffer
• https://github.com/papicella/cli-snyk-getting-started
• https://github.com/papicella/conftest-snyk-demos
• https://github.com/paras98/Log4Shell
• https://github.com/pentesterland/Log4Shell
• https://github.com/phax/ph-oton
• https://github.com/salesforce-marketingcloud/FuelSDK-Java
• https://github.com/seculayer/Log4j-Vulnerability
• https://github.com/soosmile/POC
• https://github.com/srhercules/log4j_mass_scanner
• https://github.com/tachtler/browscap4jFileReader
• https://github.com/tcoliver/IBM-SPSS-log4j-fixes
• https://github.com/tdekeyser/log4shell-lab
• https://github.com/thedevappsecguy/Log4J-Mitigation-CVE-2021-44228--CVE-2021-45046--CVE-2021-45105--CVE-2021-44832
• https://github.com/thl-cmk/CVE-log4j-check_mk-plugin
• https://github.com/tmax-cloud/install-EFK
• https://github.com/trhacknon/CVE-2021-44228-Scanner
• https://github.com/trhacknon/Pocingit
• https://github.com/trhacknon/log4shell-finder
• https://github.com/wayward710/Lablab_Vertex
• https://github.com/whitesource/log4j-detect-distribution
• https://github.com/wortell/log4j
• https://github.com/yannart/log4shell-scanner-rs
• https://github.com/yhorndt/mule-3.x-log4j-update-script
• https://github.com/zecool/cve