PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Understanding Log4Shell: the Apache log4j2 Remote Code Execution Vulnerability (CVE-2021-44228, CVE-2021-45046)

horizon3.ai | vulnerability | CVE-2021-44228 | #rce | #vulnerability-research | #apache | #log4shell | #horizon3 | #log4j2
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Understanding Log4Shell: the Apache log4j2 Remote Code Execution Vulnerability (CVE-2021-44228)…
CVE
CVE-2021-44228
Published
Collected

Related coverage

vulnerability · horizon3.ai
[CVE-2021-44228] The Long Tail of Log4Shell Exploitation
# The Long Tail of Log4Shell Exploitation Naveen Sunkavally July 13, 2022 Attack Blogs It’s been more than six months since the Log4Shell vulnerability (CVE-2021-44228) was disclosed, and a number...
vulnerability · horizon3.ai
[CVE-2021-44228] Using NodeZero to Find and Fix Log4Shell
For the past month Infosec teams have been scrambling to find instances of Log4Shell in their environments and remediate them.
vulnerability · horizon3.ai
[CVE-2021-44228] OpenSSL Critical Vulnerability: Should You Be Spooked?
On Tuesday, October 25 a new OpenSSL hot-fix release was announced which will patch a critical vulnerability that exists within the v3.0.X branch. OpenSSL 3.0.7…
vulnerability · bishopfox.com
How Bishop Fox Has Been Identifying and Exploiting Log4shell
Bishop Fox's account of the first chaotic week of Log4shell (CVE-2021-44228): JNDI/LDAP payloads sprayed via HTTP headers and DNS exfiltration when outbound TCP was blocked.
vulnerability · bugcrowd.com
Log4Shell, The Worst Java Vulnerability in Years
Log4Shell (CVE-2021-44228) is a 10.0-critical RCE affecting Apache Log4j 2.0-beta9 to 2.14.1, hitting Apple, Cloudflare, Twitter, and Minecraft—considered worse than the 2017 Apache Struts flaw.
vulnerability · blog.viettelcybersecurity.com
The Log4Shell vulnerability may have been exploited since August 2021
Analyzing DNS logger logs, Viettel researchers conclude Log4Shell exploitation may have begun around September 4, 2021 - months before disclosure - hitting at least 10 organizations worldwide.
Back