|
|
Posted on 2021-12-11 21:06:29
|
|
|
|
In the past two days, it has been swiped by the "Apache Log4j2 remote code execution vulnerability" in the circle of friends, mainly because of the Java JNDI injection vulnerability in the component: when the program writes the data entered by the user into the log, the attacker constructs a special request to trigger the remote code execution vulnerability in Apache Log4j2, thereby exploiting this vulnerability to execute arbitrary code on the target server.
Scope of influence
Apache Log4j 2.x <= 2.14.1
JNDI (Java Naming and Directory Interface) is a Java naming and directory interface provided by Java. By calling JNDI's API, applications can locate resources and other program objects. JNDI is an important part of Java EE, it should be noted that it does not only include DataSource (JDBC data source), JNDI can access existing directories and services such as: JDBC, LDAP, RMI, DNS, NIS, CORBA, excerpted from Baidu Encyclopedia.
There are many articles on the Internet about how to fix vulnerabilities and screenshots of vulnerabilities, but little about how to test the project for the vulnerability.Java uses Log4j2 to test the code mainlyAs follows:
In simple terms, Log4j2 will access the following address through the RMI or LDAP protocol, and according to the content of the protocol, it may execute maliciously constructed code.
The existence of the vulnerability is almost always proven on the Internet by opening a Windows calculator, and the code is as follows:
Since Log4J2 uses RMI or LDAP protocols to access the attacker's server, and both RMI and LDAP protocols are TCP-based, we can do it directlyUsing .NET to listen on a TCP port, if a call to log4j2 to print logs accesses the .NET listening port, it proves that there may be a vulnerability, and if not, it proves secure。
.NET generates very small test programs6kb, the code is as follows:
Try using the log4j component2.14.0The version is printed, and the rendering is as follows:
Try upgrading the log4j component to2.15.0version, executed again, the effect is as follows:
After upgrading the version, it is found that after calling the print log,The Java program no longer accesses the external port。
Interested friends, you can refer to the following link to reproduce the vulnerability and call up the calculator.
The hyperlink login is visible.
The hyperlink login is visible.
Finally, attach the test procedure:
测试程序.rar
(2.66 KB, Number of downloads: 1)
|
Previous:[Actual combat]. NET/C# Create an SQLite database and simply add, delete, modifyNext:CentOS system deployment nacos tutorial
|
Landlord|
Posted on 2021-12-13 13:37:35
|
Posted on 2021-12-20 23:09:51
|
