cbcvebase.
CVE-2017-5645
published 2017-04-17

CVE-2017-5645: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…

PriorityP186critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
89.04%
99.8th percentile
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Affected

171 ranges· showing 25
VendorProductVersion rangeFixed in
apachelog4j>= 2.0 < 2.8.22.8.2
apachelogging
apache_software_foundationapache_log4j
debianapache-log4j2< apache-log4j2 2.7-2 (bookworm)apache-log4j2 2.7-2 (bookworm)
oracleapi_gateway
oracleapplication_testing_suite
oracleautovue_vuelink_integration
oracleautovue_vuelink_integration
oraclebanking_platform
oraclebanking_platform
oraclebanking_platform
oraclebi_publisher
oraclebi_publisher
oraclebi_publisher
oraclebi_publisher
oraclecommunications_converged_application_server_service_controller
oraclecommunications_instant_messaging_server
oraclecommunications_interactive_session_recorder6.0 – 6.2
oraclecommunications_messaging_server< 8.0.28.0.2
oraclecommunications_network_integrity7.3.2 – 7.3.6
oraclecommunications_online_mediation_controller
oraclecommunications_pricing_design_center
oraclecommunications_pricing_design_center
oraclecommunications_service_broker
oraclecommunications_webrtc_session_controller< 7.27.2

Detection & IOCsextracted from sources · hover to see the quote

port4712
  • The vulnerability is triggered by sending a specially crafted serialized binary payload over TCP or UDP to Log4j's socket server. Detection should focus on unexpected or malformed Java serialized objects arriving on Log4j TCP socket server ports (default 4712).
  • The Nuclei template for this CVE uses an OAST/interactsh DNS callback to confirm exploitation — monitor for unexpected outbound DNS queries originating from Log4j socket server processes as a sign of successful deserialization RCE.
  • The Nuclei template targets port 4712 as the Log4j TCP socket server port; network-level detection should alert on inbound connections to this port carrying Java serialized object magic bytes.
  • ·Affected versions are Apache Log4j 2.x before 2.8.2. The vulnerability only exists when the TCP socket server or UDP socket server feature is explicitly enabled to receive serialized log events — it is not active by default in all deployments.
  • ·The Nuclei template sends two requests (max-request: 2) — one to the primary hostname and one specifically to port 4712 — meaning scanners should probe both the standard service port and 4712 to achieve full coverage.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_apache9.8HIGH
vendor_debian9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.