Tenable Research is providing the following supporting information about the 31 NASL detection plugins and two WAS plugin recently released in response to a critical vulnerability reported in Log4j (Log4Shell). As a reminder, it is recommended that thorough_tests are enabled for all scans using these CVE-2021-44228, CVE-2021-45046, CVE-2021-4104, and CVE-2021-45105 plugins.

NASL plugins

156183 Apache Log4j 2.x < 2.17.0 DoS

• Version check for known vuln Log4j versions related to CVE-2021-45105 in Windows, Unix and Linux systems

156057 Apache Log4j 2.x < 2.16.0

• Version check for known vuln Log4j versions related to CVE-2021-45046 in Windows, Unix and Linux systems

156165 Apache Log4j 2.x < 2.16.0 RCE

• Version check for known vuln Log4j versions related to CVE-2021-45046 in MacOS systems

156164 Apache Log4Shell CVE-2021-45046 Bypass Remote Code Execution - (Direct Check HTTP) 

• Direct Check compatible with Tenable.io Cloud Scanners and restrictive networks
• Delivers jndi:ldap crafted payloads including Session, JSession and PHPSession into the HTTP headers and then tracks the injection via DNS when the callback is made.
• Callback is needed given the nature of the vulnerability wherein the target / victim connects back to the host sending the original request and the host is vulnerable if the callback happens
• This plugin uses DNS (default port 53) for network communication.

The following Apache Log4Shell CVE-2021-44228 Direct Checks share common techniques applied on different ports and protocols. They all share the following attributes:

• Direct Checks compatible with Tenable.io Cloud Scanners and restrictive networks
• Callback is needed given the nature of the vulnerability wherein the target / victim connects back to the host sending the original request and the host is vulnerable if the callback happens
• These plugins DNS (default port 53) for network communication. 
• Delivers jndi:ldap crafted header script to select ports on a scan target and then tracks the injection via DNS when the callback is made
• CVE-2021-44228 direct check not requiring authentication

156669 Apache Log4Shell RCE detection via callback correlation (Direct Check - MSRPC)

156559 Apache Log4Shell RCE detection via callback correlation (Direct Check - RPCBIND)

156445 Apache Log4Shell RCE detection via callback correlation (Direct Check - PPTP)

156375 Apache Log4Shell RCE detection via callback correlation (Direct Check - UPnP)

156258 Apache Log4Shell RCE detection via callback correlation (Direct Check - NTP)

156257 Apache Log4Shell RCE detection via callback correlation (Direct Check - DNS)

156256 Apache Log4Shell RCE detection via callback correlation (Direct Check - SNMP)

156232 Apache Log4Shell RCE detection via callback correlation (Direct Check - SMB)

156197 Apache Log4Shell RCE detection via callback correlation (Direct Check - NetBIOS)

156166 Apache Log4Shell RCE detection via callback correlation (Direct Check - SSH)

156162 Apache Log4Shell RCE detection via callback correlation (Direct Check - Telnet)

156158 Apache Log4Shell RCE detection via callback correlation (Direct Check - IMAP)

156157 Apache Log4Shell RCE detection via callback correlation (Direct Check - POP3)

156132 Apache Log4Shell RCE detection via callback correlation (Direct Check - SMTP)

156115 Apache Log4Shell RCE detection via callback correlation (Direct Check - FTP)

156056 Apache Log4Shell RCE detection via callback correlation (Direct Check - any open port)

156035 VMware vCenter Log4Shell (Direct Check HTTP) 

• Delivers jndi:ldap crafted payloads into the HTTP header of VMWare vCenter applications installed on the remote host on a scan target and then tracks the injection via DNS when the callback is made

 156017 Apache Log4Shell RCE detection via callback correlation (Direct Check - SIP)

156016 Apache Log4Shell RCE detection via Path Enumeration (Direct Check HTTP) 

156014 Apache Log4Shell RCE detection via callback correlation (Direct Check HTTP)

CVE-2021-44228 direct check not requiring authentication

• Direct Check compatible with Tenable.io Cloud Scanners and restrictive networks
• Injects payload into the HTTP headers and then tracks the injection via DNS when the callback is made
• Callback is needed given the nature of the vulnerability wherein the target / victim connects back to the host sending the original request and the host is vulnerable if the callback happens
• This plugin uses DNS (default port 53) for network communication.

155998 Apache Log4j Message Lookup Substitution RCE (Log4Shell) (Direct Check)

CVE-2021-44228 direct check not requiring authentication

• Scanner sends jndi:ldap string to target and listens for LDAP BIND request from target
• It is not compatible with Tenable.io cloud scanners and may fail to return results in certain networks due to firewall rules or interference from other security devices.
• Callback is needed given the nature of the vulnerability wherein the target / victim connects back to the host sending the original request and the host is vulnerable if the callback happens
• This plugin uses ephemeral ports 50,000-60,000 for network communication

156001 Apache Log4j JAR Detection (Windows)

Local Windows detection **recommend Thorough Tests**  

• Checks running processes for Java instances running with Log4j in classpath and records the file paths
• Searches the file system for .jar files with known vuln Log4j filename matches (if thorough tests is enabled)

156000 Apache Log4j Installed (Unix)

Local Linux detection

• Checks rpm packages for vulnerable Log4j matches (RedHat, Gentoo, SuSE, etc.)
• Search the file system paths for known vulnerable Log4j matches (if thorough tests is enabled)

155999 Apache Log4j < 2.15.0 Remote Code Execution

Local Linux Detection (uses 156000)

• Version check for known vuln Log4j versions in Unix and Linux systems

156002 Apache Log4j < 2.15.0 Remote Code Execution

Local Windows detection (uses 156001)

• Version check for known vuln Log4j versions in Windows systems

156032 EOL plugin for Log4j 1.x

• Apache Log4j version < 1.x End of Life / Unsupported Version Detection

156103 Apache Log4j 1.2 JMSAppender Remote Code Execution (CVE-2021-4104)

• The version of Apache Log4j on the remote host is 1.2. It is, therefore, affected by a remote code execution vulnerability when specifically configured to use JMSAppender.

WAS plugins

113075- Apache Log4j Remote Code Execution (Log4Shell)

CVE-2021-44228 direct check not requiring authentication

• Inject payload into the HTTP headers, POST/GET values, XML, JSON, cookies, etc. and then track the injection via DNS when the callback is made
• Callback is needed given the nature of the vulnerability wherein the target / victim connects back to the host sending the original request and the host is vulnerable if the callback happens

113076- Apache Log4j Remote Code Execution (Log4Shell)

CVE-2021-44228 WAS Log4Shell file detection plugin

• Scan the web application directories for known vulnerable version of the Log4j installation file and flag the host if found