POJIA破甲
地图 / Log4j RCE on https://judge.me/reviews

Log4j RCE on https://judge.me/reviews

代码执行 / 代码注入 / #1427589

厂商
Judge.me
严重程度
低危
赏金
$50
弱点
代码注入
研究员
@bhishma14
披露日期
2021-12-21
资产
https://judge.me/reviews
CVE
CVE-2021-44228

该报告还没有中文解读。

原文摘录

摘自原文(995 字符中的一小部分)
Summary: CVE-2021-44228, also named Log4Shell or LogJam, is a Remote Code Execution (RCE) class vulnerability. If attackers manage to exploit it on one of the servers, they gain the ability to execute arbitrary code and potentially take full control of the system. What makes CVE-2021-44228 …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Judge.me 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @bhishma14 · 版权归作者与 Judge.me 所有

同类报告

RCE via npm misconfig -- installing internal libraries from the public registryPayPal · 2021-02-09 · $30,000Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' ApplicationPlayStation · 2020-12-04 · $15,000[phpobject in cookie] Remote shell/command executionPornhub · — · $20,000RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Starbucks · 2019-04-10Remote Code Execution in Slack desktop apps + bonusSlack · 2020-08-28RCE when removing metadata with ExifToolGitLab · 2021-05-14 · $20,000