LOG4J VULNERABILITY ASSESSMENT AND MITIGATION

What is Log4j?

Log4j, Zero-day exploit the popular Javalogginglibrarylog4j2 was discovered that results in Remote Code Execution (RCE) by logging a certain string.Log4j2 is an open-source, Java-based logging framework commonly incorporated into Apache webservers and Spring-Boot web applications. The vulnerability has been reported with CVE-2021-44228 against the log4j-corejar.CVE-2021-44228 is considered an acritical flaw, and it has a base CVSS score of 10, the highest possible severity rating.

Who is Impacted !!

Too many services are vulnerable to this exploit as log4j is a wild rang used Java-based logging utility. Cloud services like Steam, Apple iCloud, and applications like Minecraft have already been found to be vulnerable.

Anybody using Apache frameworks services or any Spring- Boot Java-based framework applications that uses log4j2 is likely to be vulnerable.

HOW THE EXPLOIT WORKS !!

The exploit works when there is a service or application running with a vulnerable version of log4j2.

An attacker who can control log messages or log message parameters can execute arbitrary code on the vulnerable server loaded from LDAP servers when message lookup substitution is enabled.

Info you have to know about LOG4SHELL exploit!

Affected Apache log4j2 Versions
Exploit Requirements
Exploit Steps

Affected Apache log4j2 Versions 2.0 <= Apache log4j <= 2.14.1

Exploit Requirements

A server with a vulnerable log4j version.
An endpoint with any protocol (HTTP, TCP, etc) that allows an attacker to send the exploit string.
log statement that logs out the string from that request.

Exploit Steps

Data from the User gets sent to the server (via any protocol),
The server logs the data in the request, containing the malicious payload.
The log4j vulnerability is triggered by this payload and the server makes a request to attacker.com via (JNDI),
This response contains a path to a remote Java class file which is injected into the server process, This injected payload triggers a second stage and allows an attacker to execute arbitrary code.

HOW TO MITIGATE

SPOT VULNERABLE APPLICATIONS

Ask admin/system team to run a search/grep command on all servers to spot any file with the name "log4j2", Then check if it is a vulnerable version or not.

PERMANENT MITIGATION

Version 2.15.0 of log4j has been released without the vulnerability. log4j-core.jar is available on Apache Log4j page below, You can download it and update your system

TEMPORARY MITIGATION

Add "log4j.format.msg.nolookups=true" to the global configuration of your server/web applications

How to install Burp Suite Professional for free on Windows

How to install Burp Suite Professional for free on Windows As this is an illegal way to use Burp Suite I am not responsible for it. It is just for educational purpose information. Burp Suite is an integrated platform for performing security testing of web applications. It is designed to be used by hands-on testers to support the testing process. Here we will see how you can install it for free on your Windows 7/8/10 64-bit machine. Requirements: Java JDK Burp Suite Pro Zip Burp Suite Latest Version After you have downloaded both the files, follow these steps: * Run the downloaded file JDK-13.0.2_windows-x64_bin.exe and let it install. * Search environment in the Windows search bar. You will see a match for Edit the system environment variables . Open it and then click the Environment Variables button at the bottom. You will see a window containing a part like this: Under the System variables tab, click New and add the following variables: Variable name: CLASSPATH Variable valu

MIUI 12 Theme Editor

Design Your MIUI 12 Themes With New MIUI Theme Editor For MIUI 12. Download New Version Here! Designing a User Interface is not an easy task to do. A person needs to have creativity in mind along with intuitive instinct to create a sleek UI design. Not all people are good at design. However, with just enough tools to use, anyone can now design their own theme bundling their own UI styles. You might have enough design skills and good art instincts. However, you won’t be able to manifest that design without a proper tool. Actualizing a design concept into a usable theme needs a certain level of coding skills. The MIUI Theme Editor allows you to customize almost any aspects of the MIUI user interface (UI). You can configure the general apps’ icons and system apps’ icons. You can also specify the default wallpaper image used within the theme. Furthermore, the lock screen and home screen areas are also customize-able. Even deeper, you can also adjust the appearance of all not

How to Deploy Multiple Dist file to the Apache Server

How to Deploy Multiple Dist file to the Apache Server To Deploy Multiple Dist file apache server the Easiest way i have describe below follow the instruction whether your project would be html, PHP or any dist file such as angular you can follow the below Steps. To Deploy any project to the Apache Server We have to make changes in 2 files and one folder. Follow the below process to Deploy the dist file. • Rename the dist file to the project name and copy the file to the Path /var/www/html/ • Make changes in the Index.html or Index.php by giving folder name in base href e.g., /foldername/ • Now Go to /etc/apache2/sites-available and make copy of 000-default.conf or any pervious file for example healthgiggle.conf Copy command cp -r healthgiggle.conf /etc/apache2/sites-available/pjname.conf • Now open the file in vi editor vi pjname.conf and make changes ServerName: Your project name which will appear in URL after main domain e.g., healthgiggle/projectname DocumentRoot: Path of the p

CEH V12 vs CEH V11 Difference

The EC-Council update launched on 7th September 2022 from its predecessor version 11 Certified Ethical Hacker Version 12 (CEH v12) is now a more up-scaled and advanced version of EC. There are various changes made in the new version 12 in the Certified Ethical Hacker credential. Understand the Difference Between CEH V11 and CEH V12 The attack methodologies and lab techniques have been enhanced and are given a new boost. The CEH v12 is one of the most sought-after and desired programs globally based on information security. In this new version, 500+ new threats and vulnerabilities are included, which can help learners work with better skills and knowledge. Difference Between CEH v11 and CEH v12 CEH V11 CEH V12 Total Number of Modules 20 20 Total Number of Slides 1640 1676 Total Number of Labs 200 220 Total Number of New Labs 92 33 Attack Techniques 420 519 New Technology Added IoT Technology, Serverless Computing, WPA3 Encryption, APT, Fileless Malware, Web API, and Web Shell MITRE A

SAST vs DAST

SAST vs DAST If you come across what is SAST and DAST. Than probably you are looking for application source code review. we will know what exactly SAST and DAST is and What’s the best approach for application security testing? The differences between SAST and DAST include where they run in the development cycle and what kinds of vulnerabilities they find. Learn why you need both. Recent high-profile data breaches have made organizations more concerned about the financial and business consequences of having their data stolen. They know they need to identify vulnerabilities in their applications and mitigate the risks. So they’re adding application security testing, including SAST and DAST, to their software development workflows. What are SAST and DAST? SAST and DAST are application security testing methodologies used to find security vulnerabilities that can make an application susceptible to attack. Static application security testing (SAST) is a white box method of testing. It exam

Apple latest iphone on a discount of 25k++ and more

Apple latest iPhone on a discount of 25k++ and more It is a month of winter when Apple is selling its mobile for a low price with great discount and offers. You can get a discount of more than 20k in this month by using a debit card and Exchanging your Old mobile with new ones. The apple has Shelved off 4300 Rs as a winter offer and you collaborate the offer with the Bank like HDFC is giving Instant Discount of About 4K Rs and also exchange value of 17500 Rs on your old devices. If you clubbed this offer you will get an offer of around Rs 25800 . You can grab this offer on Flipkart and Amazon I have given the link below just click to grab the offer. As this is the Best value for money Offer for New Apple fans and Old ones also. So grab this offer as early as possible.

How to use FoxyProxy in Mozilla Firefox for Burp Suite

How to use FoxyProxy in Mozilla Firefox for Burp Suite The foxy proxy is used to make a proxy in the browser. Foxyproxy is a browser extension that simplifies configuring proxies on browsers. It is one of the most advanced proxy switchers in the market as it has other features that other proxy switchers lack. One of the advantages of using this plugin is that the proxy setting is confined to the browser environment. Typically, when you want to configure proxies for your browser, you have to configure it from the system level, which then means that other browsers and apps have to access the Internet through the proxies you configured. Requirements Install Mozilla Firefox Install Foxyproxy Download Mozilla and Foxyproxy and install them. After installing both the application you will see the foxy proxy icon on Top right-hand side. Step to Setup Foxy proxy for burp suite Intercept 1. Go to Options and Click on ADD 2. In Title write the name and in Proxy Type Select HTTP. 3. In Proxy IP a

Odoo ORM (Object-relational Mapping)

ORM (Object-relational Mapping) in Odoo Object relation mapping is a technique that lets you query and manipulates data from a database using an object-oriented paradigm. When talking about ORM, most people are referring to a library that implements the Object-Relational Mapping technique, hence the phrase "an ORM". In simple terms, it is also defined as in Odoo a concept or technique which acts as a bridge between your programming language and your database. The Object Relational Mapping helps to execute SQL queries without writing them explicitly. Once the ORM is configured in an application, the user can use the OOP concepts like classes and objects to interact with the database. As the database in Odoo is in Postgresql so instead of writing query each time you can define one time. For example, here is a completely imaginary case with a pseudo-language: You have a student class, you want to retrieve all the student of which the branch is "Computer". Manually, yo

Xiaomi Mi Notebook 14 series in India

Xiaomi Mi Notebook Price, Specifications, India Launch Live Updates: Xiaomi launched Mi Notebook 14 and Mi Notebook 14 Horizon Edition in India. Here are the details and price of all variants. The Mi Notebook 14 comes in three variants : the base model with 8GB DDR4 RAM + 256GB SATA SSD priced at Rs 41,999 , 8GB RAM + 512GB SATA SSD priced at Rs 47,999 , and top-end model with 8GB RAM, 512GB SATA SSD, + NVIDIA GeForce MX250 priced at Rs 47,999 . Notably, these are inaugural pricing until July 16 and are subject to change. There are two options within the Horizon Edition line to choose from, and the main difference between them is the CPU. If you choose the Intel Core i5-10210U variant, you'll also get a 512GB SATA SSD, and the price will be Rs. 54,999 . The version with the Core i7-10510U and faster 512GB NVMe SSD would seem to be much better valued at Rs. 59,999 . The higher priced model also has a USB Type-C port while the lower one doesn't. KEY SP

Teck Bulls

Search This Blog