New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE coverage #14

Open

saleem024 opened this issue Jan 18, 2022 · 1 comment

Labels

saleem024 commented Jan 18, 2022

Hi,

Could you please confirm whether Log4Shell Scanner Burpsuite Pro Addon is capable to identify log4j vulnerabilities of CVE-2021-44832, CVE-2021-45105 & CVE-2021-45046.

Thanks
Saleem Choudary

v-p-b changed the title ~~Log4j Burpsuite Addon~~ CVE coverage

v-p-b added the question label

Contributor

v-p-b commented Jan 18, 2022 •

edited

Loading

CVE-2021-44832 - The attack requires modification of the configuration file. This plugin obviously can't to that (and the CVE is widely considered BS). No.
CVE-2021-45105 - This is a DoS. We don't want to kill random hosts. No.
CVE-2021-45046 - Planned support, implementation is currently not possible due to Collaborator limitations, see Additional payloads for allowedLdapHost and allowedClasses bypass #12

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment