Forum Discussion
Additional Plugins Released for Log4Shell - Apache Log4j...
Tenable has released two additional plugins for CVE-2021-44228, known as Log4Shell. Additional plugins are expected to be released in the coming days. You can track plugins for CVE-2021-44228 using this link.
The two new plugins are:
- Plugin ID 156014 - Apache Log4Shell RCE detection via callback correlation (Direct Check HTTP) - This remote check can be used to identify the vulnerability without authentication. This plugin is compatible with Tenable cloud scanners
- Plugin ID 113075 - Apache Log4j Remote Code Execution (Log4Shell) - This plugin is available for our Tenable.io Web App Scanning (WAS) customers. This is a comprehensive plugin which can be used to test input fields that could be abused to exploit Log4Shell.
Please note that in order to ensure the latest plugins are available on your scanner, you will want to manually update your plugins. Details on this process and additional updates can be found in our blog.
9 Replies
Hi Tenable Community - sanity-check on the Nessus updates to scan for this. For some servers I do not have auth (don't ask) - will the Log4Shell scan work to completion or provide partial results?
To expand on my ask - which will report good results w/o auth:
Host
Apache Log4j < 2.15.0 Remote Code Execution155999
Apache Log4j < 2.15.0 Remote Code Execution156002
Apache Log4j Installed (Linux / Unix)156000
Apache Log4j JAR Detection (Windows)156001
Web Services
Apache Log4j Message Lookup Substitution RCE (Log4Shell) (Direct Check)155998
Apache Log4Shell RCE detection via callback correlation (Direct Check HTTP)156014
Hi @Michael OHara
My colleagues have published the following note to the Research Release Highlights that breaks down how each of the plugins work including specifics on the plugins that do not require authentication:
https://community.tenable.com/s/feed/0D53a00008E3hKzCAJ
Please let me know if this answers your questions.
I have had good luck with WAS detection but I have yet to get the Nessus plugins to work. There are not firewall, NAT or interface issues to be concerned with. Hundreds of systems and zero detections. Plugins are current. Tried canned template and custom template with plugins enabled. No luck.
Any chance we could hear a little more about how this works? Does the plugin bind a listening service to the scan server for call back?
Any help would be appreciated.
Thank you,
John
Hi @John Williams,
For troubleshooting plugin related issues, I would recommend opening up a support case.
Regarding the plugins themselves, my colleagues have put together a few posts in the Research Release Highlights community that break down each of the plugins as well as explains how the callbacks work:
Overview of Tenable Plugins for Log4j 2
Overview of Callbacks in Log4j Remote Detection Plugins
I hope these resources help.
I've not had much luck with plugin 155998 or 156014 but others in my company have reported some success with these plugins. So it could be that our existing rules block this type of check.
When it comes to the other plugins, I've performed my normal scans using existing policies that are automatically updated and found nothing. When using the 4 main plugins or the provided scan template, as long as the Assessment Accuracy is set to "Perform thorough tests" I was able to successfully identify log4j files on a system. The process still requires some evaluation to prioritize but at least I was able to identify systems with the library files.
Our teams are also using other tools to help identify the vulnerabilities as well as scripts from GitHub.
Hi @John Spurlock,
I'm sorry to hear you're experiencing issues with the two remote direct check plugins. My colleagues have put together a document explaining how the callbacks work for those two plugins in particular. I hope that this document helps answer your questions. We also have another post that is an overview for each of the plugins.
If you're still experiencing issues with the plugins, I would recommend opening up a support case.
I've been also having these issues, and confirmed that the Tenable plugins don't work as expected, scanned our complete DMZ (24k IPs) for hours without a single hit... I found this on Twitter from a trusted security researcher also having the same problem, using the provided template or a custom one built adding the plugins. We have defined to not use Tenable for this, and moving to the GitHub scripts. Given the time constraint, I'd recommend to not waste time trying to work this out, unless you're doing other discovery activities in parallel.
Hi @Ivan Camero,
I'm sorry to hear you're experiencing issues with the plugins. I appreciate you letting us know. Please consider opening up a support case so that the team can investigate.
Thanks,
Satnam
