{
  "Name": "Lanxin log4j2 Remote command execution vulnerability (CVE-2021-44228)",
  "Description": "<p>Lanxin is a full-scenario intelligent security collaboration platform dedicated to serving the party, government, military, and central enterprises.</p><p>Lanxin has a log4j2 remote command execution vulnerability. Attackers can use this vulnerability to execute commands arbitrarily on the server side, write to the backdoor, obtain server permissions, and then control the entire web server.</p>",
  "Product": "Lanxin",
  "Homepage": "https://www.lanxin.cn/",
  "DisclosureDate": "2022-01-10",
  "Author": "2272759195@qq.com",
  "FofaQuery": "title==\"蓝信-企业级安全移动工作平台\" || title==\"蓝信\" || body=\"请使用蓝信扫描二维码登录\"",
  "GobyQuery": "title==\"蓝信-企业级安全移动工作平台\" || title==\"蓝信\" || body=\"请使用蓝信扫描二维码登录\"",
  "Level": "3",
  "Impact": "<p>Lanxin has a log4j2 remote command execution vulnerability. Attackers can use this vulnerability to execute commands arbitrarily on the server side, write to the backdoor, obtain server permissions, and then control the entire web server.</p>",
  "Recommendation": "<p>The supplier has released a solution, please upgrade to the new version:<a href=\"https://github.com/apache/logging-log4j2/tags/\" target=\"_blank\">https://github.com/apache/logging-log4j2/tags/</a></p><p>1. Deploy a web application firewall to monitor database operations.</p><p>2.If not necessary, prohibit public network access to the system.</p> ",
  "Translation": {
    "CN": {
	  "Name": "蓝信 log4j2 命令执行漏洞（CVE-2021-44228）",
      "Product": "蓝信",
      "VulType": [
        "命令执行"
      ],
      "Tags": [
        "命令执行"
      ],
      "Description": "<p>蓝信，是专注服务于党政军央企的全场景智能化安全协同平台。<br></p><p>蓝信&nbsp;存在 log4j2 命令执行漏洞，攻击者可通过该漏洞在服务器端任意执行命令，写入后门，获取服务器权限，进而控制整个web服务器。</p>",
	  "Impact": "<p>Lanxin 存在 log4j2 命令执行漏洞，攻击者可通过该漏洞在服务器端任意执行命令，写入后门，获取服务器权限，进而控制整个web服务器。<br></p>",
      "Recommendation": "<p>⼚商已发布了漏洞方案，请及时关注： <a href=\"https://github.com/apache/logging-log4j2/tags\">https://github.com/apache/logging-log4j2/tags</a></p><p></p><p>1、通过防⽕墙等安全设备设置访问策略，设置⽩名单访问。</p><p>2、如⾮必要，禁⽌公⽹访问该系统。</p>"
    }
  },
  "References": [
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228",
    "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
  ],
  "Is0day": false,
  "HasExp": false,
  "ExpParams": [],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "method": "GET",
        "uri": "/test.php",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          },
          {
            "type": "item",
            "variable": "$body",
            "operation": "contains",
            "value": "test",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    }
  ],
  "ExploitSteps": [
    "AND",
    {
      "Request": {
        "method": "GET",
        "uri": "/test.php",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          },
          {
            "type": "item",
            "variable": "$body",
            "operation": "contains",
            "value": "test",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    }
  ],
  "Tags": [
    "rce"
  ],
  "VulType": [
    "rce"
  ],
  "CVEIDs": [
    "CVE-2021-44228"
  ],
  "CNNVD": [
    "CNNVD-202112-799"
  ],
  "CNVD": [
    "CNVD-2021-95914"
  ],
  "CVSSScore": "10.0",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}