Injection: Apache Log4j2 Remote Code Injection¶

Identifier: cve_2021_44228

Scanner(s) Support¶

Description¶

Apache Log4j2 \<=2.14.1 JNDI features do not protect against attacker-controlled LDAP and other JNDI endpoints, allowing attackers who can control log messages or parameters to execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.

How we test: We test for Log4j remote code execution vulnerabilities by injecting JNDI lookup payloads into log messages and parameters, then analyzing responses to detect if remote code execution is possible.

Reference:

• https://logging.apache.org/log4j/2.x/security.html
• https://nvd.nist.gov/vuln/detail/CVE-2021-44228
• https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
• https://www.lunasec.io/docs/blog/log4j-zero-day/
• https://gist.github.com/bugbountynights/dde69038573db1c12705edb39f9a704a

Configuration¶

Example¶

Example configuration:

---
security_tests:
  cve_2021_44228:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.