Operational information regarding the vulnerability in the Log4j logging library.

Related tags

Security related resourceslog4jcve-2021-44228log4shell
Overview

Log4j Vulnerability (CVE-2021-44228)

This repo contains operational information regarding the vulnerability in the Log4j logging library (CVE-2021-44228). For additional information see:

Repository contents

Directory Purpose
hunting Contains info regarding hunting for exploitation
iocs Contains any Indicators of Compromise, such as scanning IPs, etc
mitigation Contains info regarding mitigation, such as regexes for detecting scanning activity and more
scanning Contains references to methods and tooling used for scanning for the Log4j vulnerability
software Contains a list of known vulnerable and not vulnerable software
tools Contains a list of tools for automatically parsing info on this repo

Please note that these directories are not complete, and are currently being expanded.

NCSC-NL has published a HIGH/HIGH advisory for the Log4j vulnerability. Normally we would update the HIGH/HIGH advisory for vulnerable software packages, however due to the extensive amounts of expected updates we have created a list of known vulnerable software in the software directory.

Contributions welcome

If you have any additional information to share relevant to the Log4j vulnerability, please feel free to open a Pull request. New to this? Read how to contribute in GitHub's documentation.

Thank you

Dear contributors, partners all over the world,

We have received an impressive/enormous number of pull requests on this repo. It contains vital information that contributes to the situational overview around the Log4j vulnerability. The list of vulnerable applications is currently one of the most up-to-date ones with continuous input from across the globe. It is still expanding and we are working hard to process all the contributions.

Due to our joint efforts and strong cooperation we are confident that we will be better equipped to manage this situation.

Thank you all very much for your hard work and we keep welcoming your input via GitHub.

Comments
  • APC - PowerChute Business Edition

    APC - PowerChute Business Edition

    Not visible anything on their site yet:

    C:\Program Files (x86)\APC\PowerChute Business Edition\agent\lib>dir | findstr log4j

    10-12-2020 18:42 264,058 log4j-api-2.11.1.jar 10-12-2020 18:42 1,607,936 log4j-core-2.11.1.jar 10-12-2020 18:42 23,242 log4j-slf4j-impl-2.11.1.jar

    PowerChute Business Edition - 10.0.2.301

    investigate 
    opened by OS3DrNick 8
  • ESET Secure Authentication

    ESET Secure Authentication

    ESET states that they're not vulnerable, but we have various companies that Have ESET Secure Authentication installed and perform a scan for files, then we see that log4j is included in ESET Secure Authentication in the Elasticsearch component which they're shipping in their binary.

    [2021-12-16 10:19:27.784944] VULNERABLE: C:\Program Files\ESET Secure Authentication\elasticsearch\lib\log4j-core-2.11.1.jar -> org\apache\logging\log4j\core\net\JndiManager.class [04fdd701809d17465c17c7e603b1b202: log4j 2.9.0 - 2.11.2]

    [2021-12-16 10:19:28.847458] VULNERABLE: C:\Program Files\ESET Secure Authentication\elasticsearch\search-guard-tlstool-1.7\deps\log4j-core-2.11.1.jar -> org\apache\logging\log4j\core\net\JndiManager.class [04fdd701809d17465c17c7e603b1b202:log4j 2.9.0 - 2.11.2]

    software PR-requested 
    opened by nvaert1986 6
  • Add Waters product statement

    Add Waters product statement

    Add product statement for family of Waters informatics solutions

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • [x ] PR Title: Please use "Add <vendor/product name>" (instead of "Update README.md")
    • [x ] Status: please select a value from the status table at the top
    • [ x] Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • [x ] Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • [x ] Please mind the sorting
    software Stale 
    opened by StefanTIB 5
  • Update voor Dell EMC Unity

    Update voor Dell EMC Unity

    Dell EMC heeft versie 5.1.2.0.5.007 voor de Dell EMC Unity uitgebracht. "This release addresses the Apache Log4j issue", maar aangezien er (nog) geen release notes beschikbaar zijn weet ik niet welke van de CVE's wel of niet verholpen zijn.

    opened by dennixxNL 5
  • Add Fedex Ship Manager

    Add Fedex Ship Manager

    Updated Fedex Ship Manager to 3509, adding notes about pending 3510 update 1/24.

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • [ ] PR Title: Please use "Add <vendor/product name>" (instead of "Update README.md")
    • [ ] Status: please select a value from the status table at the top
    • [ ] Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • [ ] Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • [ ] Please mind the sorting
    software Stale 
    opened by Gadgetgeek2000 5
  • FEDEX Ship Manager

    FEDEX Ship Manager

    Following files were found on the FEDEX Ship Manager server installation, version 3508:

    C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-api-2.8.2.jar C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-core-2.8.2.jar C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-jcl-2.8.2.jar C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-slf4j-impl-2.8.2.jar C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4jna-api-2.0.jar

    software PR-requested 
    opened by Gadgetgeek2000 5
  • Add Beyond Compare and Bitwarden not vuln

    Add Beyond Compare and Bitwarden not vuln

    Neighter are vuln Beyondcompare makes the remark in the footer of there site.

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • Status: please select a value from the status table at the top
    • Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • Please mind the sorting
    • Please put vendor/product name in PR title (instead of "Update README.md")
    opened by abtomat-inf 5
  • Added note from Schneider Electric about APC software

    Added note from Schneider Electric about APC software

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • Status: please select a value from the status table at the top
    • Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • Please mind the sorting
    • Please put vendor/product name in PR title (instead of "Update README.md")
    opened by ipbgeek 5
  • Add Fujifilm to software list

    Add Fujifilm to software list

    from advisory sent by vendor

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • [x] PR Title: Please use "Add <vendor/product name>" (instead of "Update README.md")
    • [x] Status: please select a value from the status table at the top
    • [x] Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • [x] Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • [x] Please mind the sorting
    software Stale 
    opened by alkajazz 4
  • Update software_list_s.md

    Update software_list_s.md

    Updated Stormshield with specific advisory for StormShield Visibility Center (only product announced vulnerable to CVE-2021-44228) Updated SonicWall product list based on v2.3 of their advisory

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • [x] PR Title: Please use "Add <vendor/product name>" (instead of "Update README.md")
    • [x] Status: please select a value from the status table at the top
    • [x] Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • [x] Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • [x] Please mind the sorting
    software 
    opened by anssi-cvp 4
  • please improve formatting quality

    please improve formatting quality

    The quality of markdown tables is slowly deteriorating:

    • some entries don't have a trailing |, some do
    • some table uses a different separator than |:----, namely |----

    This makes it hard for automated parsing tools to access the data.

    Doing a one-shot cleanup and sending a pull request fixing half the entries would not be wise, because it would make all the other waiting pull requests unmergeable. Also, implementing a commit hook would make the entire file un-commitable.

    My idea would be to

    • fix |:--- manually
    • ask contributors for a more rigid input formatting
    • add a pre-merge-commit hook, that would only check the diff for violations of the code, so that the old code can still be ugly (for some time)
    software PR-requested 
    opened by milankowww 4
Releases(log4shell_info_20220615)
Owner
Nationaal Cyber Security Centrum (NCSC-NL)
Nationaal Cyber Security Centrum (NCSC-NL)
GitHub Repository
DomainMonitor is a web project that has a RESTful API to get a domain's subdomains and whois data.

DomainMonitor is a web project that has a RESTful API to get a domain's subdomains and whois data.

2 Feb 05, 2022
Keystroke logging, often referred to as keylogging or keyboard capturing

Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of recording the keys struck on a keyboard, typically covertly, so that a person using the keyboard is unaware

Harsha G 2 Jan 11, 2022
Metal Gear Online 2 (MGO2) stage files decryption

Metal Gear Online 2 decryption tool Metal Gear Online 2 (MGO2) has an additional layer of encryption for stage files. I was not able to find info abou

4 Sep 02, 2022
LinOTP - the open source solution for two factor authentication

LinOTP LinOTP - the Open Source solution for multi-factor authentication Copyright © 2010-2019 KeyIdentity GmbH Coypright © 2019- arxes-tolina GmbH In

LinOTP 462 Jan 02, 2023
Official repository for Pyew.

pyew Pyew is a (command line) python tool to analyse malware. It does have support for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits), PE

Joxean 362 Nov 28, 2022
A kAFL based hypervisor fuzzer which fully supports nested VMs

hAFL2 hAFL2 is a kAFL-based hypervisor fuzzer. It is the first open-source fuzzer which is able to target hypervisors natively (including Hyper-V), as

SafeBreach Labs 115 Dec 07, 2022
DNSpooq - dnsmasq cache poisoning (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685)

dnspooq DNSpooq PoC - dnsmasq cache poisoning (CVE-2020-25686, CVE-2020-25684, CVE-2020-25685) For educational purposes only Requirements Docker compo

Teppei Fukuda 80 Nov 28, 2022
Brute-Force-Connected

Brute-Force-Connected Guess the password for Connected accounts the use : Create a new file and put usernames and passwords in it Example : joker:1234

4 Jun 05, 2022
A small Python Script To get all levels of subdomains from a list

getlevels A small Python Script To get all levels of subdomains Easily get 1st level, 2nd level, 3rd level, 4th level .... nth level subdomains Usag

9 Feb 15, 2022
A Modified version of TCC's Osprey poc framework......

fierce-fish fierce-fish是由TCC(斗象能力中心)出品并维护的开源漏洞检测框架osprey的改写，去掉臃肿功能的精简版本poc框架 PS：真的用不惯其它臃肿的功能，不过作为一个收集漏洞poc && exp的框架还是非常不错的！！！ osprey For beginners fr

lUc1f3r11 10 Dec 30, 2022
Nmap automated port scanner written in Python

port-scanner Nmap automated port scanner written in Python. USE: Clone the module Import the module: from portscanModule import portscanner Use: ports

Brayden Karnes 1 Dec 03, 2021
Log4j minecraft with python

Apache-Log4j Apache Log4j 远程代码执行 攻击者可直接构造恶意请求，触发远程代码执行漏洞。漏洞利用无需特殊配置，经阿里云安全团队验证，Apache Struts2、Apache Solr、Apache Druid、Apache Flink等均受影响 Steps 【Import

manmade 57 Oct 03, 2022
信息收集自动化工具

水泽-信息收集自动化工具 郑重声明：文中所涉及的技术、思路和工具仅供以安全为目的的学习交流使用，任何人不得将其用于非法用途以及盈利等目的，否则后果自行承担。 0x01 介绍 作者：Ske 团队：0x727，未来一段时间将陆续开源工具，地址：https://github.com/0x727 定位：协助

0x727 2.7k Jan 09, 2023
Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.

The Recon-ng Framework Recon-ng content now available on Pluralsight! Recon-ng is a full-featured reconnaissance framework designed with the goal of p

2.4k Jan 07, 2023
Metasploit Multi Purpose Exploiting Toolkit For Termux

MSF-EXPLOIT MSF-ANDRO is a Metasploit Multi Purpose Exploiting Toolkit For Termux . Only a Basic Script , Still in Development . FEATURES : Install Me

Mr.X 22 Dec 29, 2022
Spring4Shell - Spring Core RCE - CVE-2022-22965

Spring Core RCE - CVE-2022-22965 After Spring Cloud, on March 29, another heavyweight vulnerability of Spring broke out on the Internet: Spring Core R

Malte Gejr 118 Dec 31, 2022
Get important strings inside [Info.plist] & and Binary file also all output of result it will be saved in [app_binary].json , [app_plist_file].json file

Get important strings inside [Info.plist] & and Binary file also all output of result it will be saved in [app_binary].json , [app_plist_file].json file

12 Sep 28, 2022
A python tool capable of creating HUGE wordlists. Has the ability to add custom words for concatenation in any way you see fit.

A python tool capable of creating HUGE wordlists. Has the ability to add custom words for concatenation in any way you see fit.

Codex 9 Oct 05, 2022
A proxy server application written in python for trial purposes

python-proxy-server This is a proxy server ❤️ application written in python ❤️ for trial purposes. The purpose of the application; Connecting to Hacke

Ali Kasimoglu 2 Dec 27, 2021
Script Crack Facebook Premium 🚶‍♂

prem Script Crack Facebook Premium 🚶‍♂ Install Script $ pkg update && pkg update $ termux-setup-storage $ pkg install git $ pkg install python $ pip

Yumasaa 1 Dec 03, 2021