CVEs-PoC/2018/CVE-2018-1285.md

CVE-2018-1285

Description

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

POC

Reference

• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2021.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/SeppPenner/outlookcaldavsynchronizer-german-readme
• https://github.com/alex-ermolaev/Log4NetSolarWindsSNMP-
• https://github.com/aluxnimm/outlookcaldavsynchronizer
• https://github.com/jnewman-sonatype/DotNetTest
• https://github.com/shiftingleft/dotnet-scm-test
• https://github.com/wwwuui2com61/53_15498
• https://github.com/wwwuuid2com47/62_15498