Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
log4shell-CVE-2021-44228 — Deliberately vulnerable Java/Maven fixture for testing Log4Shell (CVE-2021-44228) detection, code-impact classification, and remediation guidance in ShieldOps. | Kitploit
Tools/GitHubGitHub/rh-rahulshetty/log4shell-cve-2021-44228
Static Code Analysis (SAST)Vulnerability AnalysisCode AnalysisSecurity VirtualizationDevSecOpsSupply Chain SecurityLearning & Education
GitHubrh-rahulshetty/log4shell-cve-2021-44228

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

log4shell-CVE-2021-44228

Deliberately vulnerable Java/Maven fixture for testing Log4Shell (CVE-2021-44228) detection, code-impact classification, and remediation guidance in ShieldOps.

View Repository
5h 46m agoNot yet reviewed

Log4Shell direct-impact fixture

Deliberately vulnerable, non-deployable Java/Maven input for ShieldOps. Do not build, execute, or deploy it.

The project pins org.apache.logging.log4j:log4j-core:2.14.1. LoginAuditService.recordLoginAttempt sends an unauthenticated HTTP User-Agent value into a Log4j message parameter. That is the attacker-controlled-message condition described for CVE-2021-44228.

Expected findings:

  • package applicability: affected;
  • code impact: LoginAuditService.java should be classified as impacted, not merely an import;
  • severity: critical (NVD CVSS 3.1 score 10.0);
  • durable remediation: upgrade Log4j and rebuild/redeploy the artifact;
  • source/control alternative: remove the attacker-controlled value from the vulnerable logging path;
  • temporary configuration mitigation: only when the exact Log4j/JVM combination supports the documented control, with residual risk and an upgrade follow-up;
  • deployment guidance: separate conditional advice for containers, Kubernetes, and bare-metal hosts, including SELinux validation rather than advice to disable enforcement.

Import from the ShieldOps repository root:

root@kitploit:~
uv run shieldops create-case "Log4Shell direct impact demo"
uv run shieldops intake --case <case-id> --input hack/log4shell-direct-impact/intake.json
uv run shieldops cases
uv run shieldops investigate --case <case-id> \
  --finding 'CVE-2021-44228:maven:org.apache.logging.log4j:log4j-core:2.14.1'

Authoritative records:

  • https://logging.apache.org/security.html#CVE-2021-44228
  • https://nvd.nist.gov/vuln/detail/CVE-2021-44228
  • https://api.osv.dev/v1/vulns/CVE-2021-44228
Download Tool