Descrizione
In questo video descrivo la CVE-2021-44228, una recente vulnerabilità scoperta in log4j, una libreria molto famosa utilizzata per gestire i file di log delle applicazioni java.
Timestamps
00:00 introduzione alla CVE-2021-44228
01:33 requisiti necessari per l’attacco
03:30 exploitation (in teoria)
10:43 exploitation (in pratica)
23:00 conclusione
Riferimenti / Materiale
- https://www.lunasec.io/docs/blog/log4j-zero-day/
- GitHub - christophetd/log4shell-vulnerable-app: Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228).
- https://github.com/feihong-cs/JNDIExploit
- PSA: Log4Shell and the current state of JNDI injection – – Random ramblings, exploits and projects.
- https://blog.cloudflare.com/actual-cve-2021-44228-payloads-captured-in-the-wild/
- Log4j Analysis: More JNDI Injection – !
- https://christine.website/blog/open-source-broken-2021-12-11
- Professional maintainers: a wake-up call