Added current known bypass patterns

Source: https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words
2021-12-13 15:49:08 +05:30
parent 27f1edbc8f
commit 6c8b0c8fd8
1 changed files with 4 additions and 0 deletions
@@ -37,6 +37,10 @@ detection:
        - '${${env:BARFOO:-j}'
        - '${::-l}${::-d}${::-a}${::-p}'
        - '${base64:JHtqbmRp'
+        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
+        - '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
+        - '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
+        - '${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://'
    condition: keywords
 falsepositives:
    - Vulnerability scanning