PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2021-45046] Log4j Vulnerability Activity on the HackerOne Platform

hackerone.com | vulnerability | CVE-2021-45046 | #bug-bounty | #zero-day | #vulnerability-management | #java | #log4j | #apache | #log4shell | #cve-2021-44228 | #cve-2021-45046
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's coverage of Log4Shell: the incomplete 2.15.0 patch led to CVE-2021-45046, upgraded to critical (CVSS 9.0), with advice to upgrade to Log4j 2.16.0 and add Log4j bugs to bounty scope.
CVE
CVE-2021-45046
Published
Collected

Related coverage

vulnerability · netspi.com
[CVE-2021-44228] Log4j: Is My Organization Impacted?
Find out if your organization is vulnerable to the Log4j vulnerabilities, read about the impact of CVE-2021-44228 and its variants, and learn mitigation steps to take.
research · blog.viettelcybersecurity.com
CVE-2021-44228 | Lỗ hổng NGHIÊM TRỌNG trên thư viện Apache Log4j và các vấn đề liên quan
An overview of Log4Shell (CVE-2021-44228): unauthenticated JNDI injection RCE in Log4j 2.0-beta9 through 2.14.1, rated CVSS 10, noting JNDI injection research dates back to Black Hat 2016.
vulnerability · bishopfox.com
How Bishop Fox Has Been Identifying and Exploiting Log4shell
Bishop Fox's account of the first chaotic week of Log4shell (CVE-2021-44228): JNDI/LDAP payloads sprayed via HTTP headers and DNS exfiltration when outbound TCP was blocked.
vulnerability · bugcrowd.com
Log4Shell, The Worst Java Vulnerability in Years
Log4Shell (CVE-2021-44228) is a 10.0-critical RCE affecting Apache Log4j 2.0-beta9 to 2.14.1, hitting Apple, Cloudflare, Twitter, and Minecraft—considered worse than the 2017 Apache Struts flaw.
Critical · vulnerability · github.com
Log4j FilteredObjectInputStream Bypass: Pre-auth RCE via MarshalledObject
This PoC demonstrates an unexpected filter-bypass gadget in Log4j 2, emphasizing the danger of unauthenticated serialized object ingestion.
vulnerability · blog.viettelcybersecurity.com
The Log4Shell vulnerability may have been exploited since August 2021
Analyzing DNS logger logs, Viettel researchers conclude Log4Shell exploitation may have begun around September 4, 2021 - months before disclosure - hitting at least 10 organizations worldwide.
Back