GHSA-jfh8-c2jp-5v3q
marshalsec
| GHSA-jfh8-c2jp-5v3q | marshalsec | |
|---|---|---|
| 9 | 7 | |
| - | 3,211 | |
| - | - | |
| - | 0.0 | |
| - | over 1 year ago | |
| Java | ||
| - | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
GHSA-jfh8-c2jp-5v3q
- GLPI IS NOT affected by the Log4j vulnerability CVE-2021-44228
-
Ghidra 10.1 Released
Includes fix for CVE-2021-44228 (https://github.com/advisories/GHSA-jfh8-c2jp-5v3q)
- Is this something that effects mining machines as well ? Any miner that can enlighten me about this problem?
- Warning for people playing on Minecraft servers. This is important!
- Security Issue - Minecraft 1.18.1 Release Candidate 3 Is Out!
-
WARNING: DO NOT LOG ONTO PUBLIC SERVERS, NEW ZERO-DAY SECURITY VULNERABILITY FOUND FOR 1.7-1.18
GitHub posted an advisory heres the link and proof-of-concept for those of you interested. https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
- Remote code injection in Log4j
- Log4j RCE Found
marshalsec
-
How do I construct a curl command for a log4shell ldap server?
I'm using this: https://github.com/mbechler/marshalsec as an LDAP server.
-
A Study Notes of Exploit Spring Boot Actuator
According to the introduction in https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf, in addition to the javax.script.ScriptEngineManager class , we can also use the com.sun.rowset.JdbcRowSetImplclass to complete the exploitation through JNDI injection. The payload is as follows
-
Log4Shell log4j vulnerability (CVE-2021-44228) - cheat-sheet reference guide
Not sure if that method actually works since LDAP is a different protocol than HTTP? If you're running an HTTP server as the receiver, then your server is just going to be confused by the connection and it might not log anything. You either want to run an LDAP server like https://github.com/mbechler/marshalsec , or have some logging method that triggers on any TCP connection, or use a service like dnslog.cn that can log for you. (although I've seen a lot of companies are now specifically blocking that domain which seems silly).
- GitHub taking down tools allowing defenders to reproduce the Log4j vulnerability
- WTH
- Java Unmarshaller Security – Turning your data into code execution
- Log4j RCE Found
What are some alternatives?
Apache Log4j 2 - Apache Log4j 2 is a versatile, feature-rich, efficient logging API and backend for Java.
Java-Deserialization-Cheat-Sheet - The cheat sheet about Java Deserialization vulnerabilities
tsunami-security-scanner-plugins - This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
logging-log4j1 - Apache log4j1
JNDIExploit - 一款用于JNDI注入利用的工具，大量参考/引用了Rogue JNDI项目的代码，支持直接植入内存shell，并集成了常见的bypass 高版本JDK的方式，适用于与自动化工具配合使用。
log4shell - Operational information regarding the log4shell vulnerabilities in the Log4j logging library.
jdk8u - https://wiki.openjdk.org/display/jdk8u
FizzBuzz Enterprise Edition - FizzBuzz Enterprise Edition is a no-nonsense implementation of FizzBuzz made by serious businessmen for serious business purposes.
terminal-escape-injections - A repository dedicated to terminal escape injections.
lunasec - LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/