-
Notifications
You must be signed in to change notification settings - Fork 2
123 lines (104 loc) · 5.05 KB
/
extended-test.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
name: Extended test
on:
pull_request:
branches: [ main ]
workflow_dispatch:
permissions:
contents: read
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
egress-policy: audit
- uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
- name: Build the images
run: |
./build_images.sh
# Simple non-vulnerable scenarios
- name: Test the exploit lab using the python cli with --java-version 8 --log4j-version 2.12.2 [Non vulnerable]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.12.2 --debug 2>&1 | tee output.txt
grep "not vulnerable to CVE-2021-44228" output.txt
rm output.txt
- name: Test the exploit lab using the python cli with --java-version 8 --log4j-version 2.15.0 [Non vulnerable]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.15.0 --debug 2>&1 | tee output.txt
grep "not vulnerable to CVE-2021-44228" output.txt
rm output.txt
# Simple vulnerable scenarios
- name: Test the exploit lab using the python cli with --java-version 8 --log4j-version 2.12.1 [vulnerable]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.12.1 --debug 2>&1 | tee output.txt
grep -v "not vulnerable to CVE-2021-44228" output.txt
rm output.txt
- name: Test the exploit lab using the python cli with --java-version 8 --log4j-version 2.14.0 [vulnerable]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.14.0 --debug 2>&1 | tee output.txt
grep -v "not vulnerable to CVE-2021-44228" output.txt
rm output.txt
# Testing Disable message lookup mitigation
- name: Test Disable message lookup mitigation with --java-version 8 --log4j-version 2.14.0 (java8) [Not vulnerable]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.14.0 --debug --disable-message-lookup 2>&1 | tee output.txt
grep "not vulnerable to CVE-2021-44228" output.txt
rm output.txt
- name: Test Disable message lookup mitigation with --java-version 8 --log4j-version 2.9.0 (java8) [Vulnerable]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.9.0 --debug --disable-message-lookup 2>&1 | tee output.txt
grep -v "not vulnerable to CVE-2021-44228" output.txt
rm output.txt
# Testing Remove JNDI lookup class mitigation
- name: Test Remove JNDI lookup class mitigation with --java-version 8 --log4j-version 2.14.0 [Not vulnerable]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.14.0 --remove-jndi-lookup-class 2>&1 | tee output.txt
grep "not vulnerable to CVE-2021-44228" output.txt
rm output.txt
- name: Test Thread Context exploit --java-version 8 --log4j-version 2.14.0 [Not vulnerable]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.14.0 --remove-jndi-lookup-class --exploit-via-thread-context 2>&1 | tee output.txt
grep -v "not vulnerable to CVE-2021-44228" output.txt
grep "vulnerable to CVE-2021-44228" output.txt
rm output.txt
# Testing com.sun.jndi.ldap.object.trustURLCodebase mitigation
- name: Test com.sun.jndi.ldap.object.trustURLCodebase mitigation with --java-version 8 --log4j-version 2.14.0 (java8) [vulnerable to exfil (at least)]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.14.0 --disable-trust-url 2>&1 | tee output.txt
grep "Possible exfiltration" output.txt
grep "not vulnerable to CVE-2021-44228" output.txt
rm output.txt
- name: Test com.sun.jndi.ldap.object.trustURLCodebase mitigation with --java-version 8 --log4j-version 2.3.0 (java8) [Not vulnerable]
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.9.1 --disable-trust-url 2>&1 | tee output.txt
grep "not vulnerable to CVE-2021-44228" output.txt
rm output.txt
# Testing a error handling for non existing log4j versions:
- name: Testing a error handling for non existing log4j versions
run: |
#!/bin/sh
set -x
python log4shell_validator.py --java-version 8 --log4j-version 2.8.0 --disable-trust-url 2>&1 | tee output.txt
grep "The version of log4j you specified does not seem to exist" output.txt
rm output.txt