PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Log4Shell, Ten Days On: YesWeHack’s Hunters Are at the Forefront of Securing Organisations

yeswehack.com | vulnerability | #bug-bounty | #supply-chain | #zero-day | #log4j | #log4shell | #vulnerability-analysis
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Ten days after Log4Shell, YesWeHack explains why the ubiquitous Log4j library became the internet's Achilles' heel and how its hunter community helped organisations respond to the fallout.
Published
Collected

Related coverage

vulnerability · bishopfox.com
How Bishop Fox Has Been Identifying and Exploiting Log4shell
Bishop Fox's account of the first chaotic week of Log4shell (CVE-2021-44228): JNDI/LDAP payloads sprayed via HTTP headers and DNS exfiltration when outbound TCP was blocked.
vulnerability · hackerone.com
Log4j Vulnerability Activity on the HackerOne Platform
HackerOne's coverage of Log4Shell: the incomplete 2.15.0 patch led to CVE-2021-45046, upgraded to critical (CVSS 9.0), with advice to upgrade to Log4j 2.16.0 and add Log4j bugs to bounty scope.
vulnerability · bugcrowd.com
Log4Shell, The Worst Java Vulnerability in Years
Log4Shell (CVE-2021-44228) is a 10.0-critical RCE affecting Apache Log4j 2.0-beta9 to 2.14.1, hitting Apple, Cloudflare, Twitter, and Minecraft—considered worse than the 2017 Apache Struts flaw.
vulnerability · blog.viettelcybersecurity.com
The Log4Shell vulnerability may have been exploited since August 2021
Analyzing DNS logger logs, Viettel researchers conclude Log4Shell exploitation may have begun around September 4, 2021 - months before disclosure - hitting at least 10 organizations worldwide.
vulnerability · netspi.com
[CVE-2021-44228] Log4j: Is My Organization Impacted?
Find out if your organization is vulnerable to the Log4j vulnerabilities, read about the impact of CVE-2021-44228 and its variants, and learn mitigation steps to take.
blog · hackerone.com
Log4Shell: Attack Evolution
HackerOne data shows 2,000+ Log4Shell reports to 400+ customers, mostly in the first 14 days, with $607,000 in bounties awarded—yet Log4j's ubiquity means the threat will linger through 2022.
Back