25 lines
974 B
Markdown
25 lines
974 B
Markdown
|
---
|
||
|
|
title: "Log4Shell"
|
||
|
|
date: 2022-01-12T14:07:23+05:30
|
||
|
|
draft: false
|
||
|
|
tags: ["exploit", "linux", "windows"]
|
||
|
|
---
|
||
|
|
|
||
|
|
The Log4Shell exploiter exploits [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).
|
||
|
|
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
Some versions of Apache Log4j, a Java logging framework, have a logging feature called “Message Lookup Substitution” enabled by default. This allows replacing certain special strings by dynamically-generated strings at the time of logging. If log messages or log message parameters can be controlled by an attacker, arbitrary code can be executed. The Log4Shell exploiter takes advantage of this vulnerability to propagate to a victim machine.
|
||
|
|
|
||
|
|
To learn about the appropriate mitigations and read more, click [here](https://logging.apache.org/log4j/2.x/security.html#Fixed_in_Log4j_2.15.0_.28Java_8.29).
|
||
|
|
|
||
|
|
|
||
|
|
### Services exploited
|
||
|
|
|
||
|
|
The following services are attempted to be exploited:
|
||
|
|
|
||
|
|
- Apache Solr
|
||
|
|
- Apache Tomcat
|
||
|
|
- Logstash
|