RCE 0-day exploit found in log4j, a popular Java logging package

• Log4jAttackSurface

  40 2,085 0.0

Dig the commit back up: https://github.com/YfryTchsGD/Log4jAttackSurface/tree/31571e29052b91fb64b54fdb7085b45f9a31de3b

• semgrep-rules

  8 707 9.4 Solidity

  Semgrep rules registry

  

There is a new semgrep rule to find potential injection points in the source code: https://github.com/returntocorp/semgrep-rules/pull/1650/commits

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• active-scan-plus-plus

  3 203 4.1 Python

  ActiveScan++ Burp Suite Plugin

  

I've put detection for this into ActiveScan++: https://github.com/PortSwigger/active-scan-plus-plus/commit/b485a0744140533d877ce244603502b42f9c6656

• Apache Log4j 2

  108 3,276 9.9 Java

  Apache Log4j 2 is a versatile, feature-rich, efficient logging API and backend for Java.

  

This conversation on the Apache github (based on the research of ceki, who is apparently the mind behind log4j 1.x) would seem to indicate otherwise. Log4j 1.x does not have a lookup mechanism and JMS Appender (which does the lookup for Log4j 1.x) does not have this vulnerability.

• apache-log4j-rce-poc

  1 2 0.0 Java

I published some code with detailed steps 写了下详细的复现步骤 https://github.com/udoless/apache-log4j-rce-poc

• apache-log4j-rce-poc

  1 58 0.0

Proof of Concept

• Logout4Shell

  34 1,727 2.6 Java

  Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

• CVE-2021-44228-Log4Shell-Hashes

  11 153 0.0

  Hashes for vulnerable LOG4J versions

For example search for the vulnerable files: https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes

• ThreatMapper

  32 4,637 9.9 TypeScript

  Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more.

  

All of us are scrambling to upgrade to 2. This OSS tool can help prioritise attack paths using runtime context. We had a potential exposure due to Elasticsearch, found out and patched. https://github.com/deepfence/ThreatMapper

• Log4JShell-Bytecode-Detector

  4 50 0.0 Java

  Local Bytecode Scanner for the Log4JShell Vulnerability (CVE-2021-44228)

  

u/sanitybit My colleagues have written a detector for the vulnerability: https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector

Suggest a related project