CVE-2021-44832
MEDIUM EXPLOITED IN THE WILD RANSOMWAREApache Log4j 2.0-beta7-2.17.0 - Remote Code Execution via JDBC Appender JNDI LDAP Data Source
Title source: llmExploitation Summary
CVE-2021-44832 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns. EIP tracks 2 public exploits from researchers including cckuailong, name.
AI-analyzed exploit summary This repository contains a working PoC for CVE-2021-44832, a Log4j 2.17.0 RCE vulnerability. It leverages JNDI injection via a malicious LDAP server to achieve remote code execution by loading a malicious configuration file.
Description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Exploits (2)
This repository contains a working PoC for CVE-2021-44832, a Log4j 2.17.0 RCE vulnerability. It leverages JNDI injection via a malicious LDAP server to achieve remote code execution by loading a malicious configuration file.
This Rust-based scanner identifies files potentially vulnerable to CVE-2021-44832 by detecting Logger.class files with 'log4j' in their names or JAR files not containing '2.17.1' in their names. It does not exploit the vulnerability but aids in discovery.
References (12)
Scores
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H