Can we find Log4Shell with Java Fuzzing? 🔥
(CVE-2021-44228 - Log4j RCE)
In this video, I’m trying to find the famous java Log4Shell RCE (CVE-2021-44228) using fuzzing. I’m targeting apache log4j2 version 2.14.1 and I’m using Jazzer, the Java fuzzer developed by Code Intelligence. I will show and give you everything to reproduce the same at home 😉 Don’t forget to patch the log4j security vulnerability by switching to log4j2 version 2.15.0
NOTES
More about Log4Shell (CVE-2021-44228)
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
- https://www.tenable.com/blog/cve-2021-44228-proof-of-concept-for-critical-apache-log4j-remote-code-execution-vulnerability
- https://www.randori.com/blog/cve-2021-44228/
- advisories: https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592
- patch: https://github.com/apache/logging-log4j2/pull/608
Modify Jazzer maven/bazel configs
Create your fuzz target
Run the fuzzer
You will get access of the complete tutorial with source code, cheat sheet and or complete video tutorial right below or at this address.
I hope you will appreciate and you can discover more about my courses here.
Thank You,
Patrick Ventuzelo / @Pat_Ventuzelo