Judge.me · Report #1427589

Log4j RCE on https://judge.me/reviews

Validstatus

$50bounty

40upvotes

21 Dec 2021disclosed

How it was found

Summary: CVE-2021-44228, also named Log4Shell or LogJam, is a Remote Code Execution (RCE) class vulnerability. If attackers manage to exploit it on one of the servers, they gain the ability to execute arbitrary code and potentially take full control of the system. What makes CVE-2021-44228 especially dangerous is the ease of exploitation: even an inexperienced hacker can successfully execute an attack using this vulnerability. According to the researchers, attackers only need to force the application to write just one string to the log, and after that they are able to upload their own code into the application due to the message lookup substitution function.

Supporting Material/References: Picture and Logs was Uploaded as a proof.

https://www.tenable.com/blog/cve-2021-44228-proof-of-concept-for-critical-apache-log4j-remote-code-execution-vulnerability

Remediation: Update the log4j jar to 2.15 or 2.16

Impact

Successful attack leads Arbitary Code Execution on the application

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original