Exploit for cve-deep-dives CVE-2021-44228 CVE-2023-4966

## https://sploitus.com/exploit?id=43D5CC10-774F-5849-ADAB-2EB170B555AC
# CVE Deep-Dives

> In-depth technical analyses of significant vulnerabilities — each writeup covers root cause, exploitation mechanics, detection logic (KQL + Sigma), hunting for historical compromise, remediation, and compensating controls.

## Why This Repo

A CVE is a four-character code. A *deep-dive* is the difference between *knowing what CVE-2021-44228 is* and *being able to explain why your JDK version matters, why WAF signatures are insufficient, how to detect exploitation in logs, and what a reasonable 7-day remediation plan looks like*.

For vulnerability management practitioners, the skill to read an advisory, reproduce the vuln in a lab, build detection, and guide remediation at scale is the differentiator between a "ticket closer" and a senior VM engineer. This repo captures that workflow for high-impact CVEs.

## Writeup Template

Every writeup follows a consistent structure for skim-readability:

1. **Executive Summary** — one-paragraph briefing for leadership
2. **Vulnerability Analysis** — CWE, affected versions, root cause explanation
3. **Exploitation Mechanics** — how attackers actually weaponize it
4. **Detection** — KQL (Microsoft Sentinel) + Sigma rules, with data source requirements
5. **Hunting for Historical Compromise** — queries for retroactive detection
6. **Remediation** — patch guidance, version matrix, validation steps
7. **Compensating Controls** — when immediate patching is not possible
8. **Lessons Learned** — VM program takeaways, broader patterns

## Writeups

| CVE | Vulnerability | Year | Severity | Status |
|-----|---------------|------|----------|--------|
| [CVE-2021-44228](writeups/CVE-2021-44228-Log4Shell.md) | Apache Log4j JNDI RCE (Log4Shell) | 2021 | 10.0 Critical | KEV |
| [CVE-2023-4966](writeups/CVE-2023-4966-CitrixBleed.md) | Citrix NetScaler ADC / Gateway session hijack (Citrix Bleed) | 2023 | 9.4 Critical | KEV |

## Methodology

Each writeup is built by:

1. Reading the original advisory, CVE entry, and vendor security bulletins
2. Reviewing at least two independent technical analyses from reputable security research (Mandiant, Rapid7, SentinelLabs, Volexity, GreyNoise, etc.)
3. Reproducing in a lab where safely possible
4. Writing detection queries that have been tested against known exploitation telemetry
5. Validating remediation steps against vendor-supported upgrade paths
6. Cross-referencing CISA KEV and FIRST.org EPSS for real-world exploitation context

## Contributing

See an error? Found a better detection query? Open an issue or a PR.