Skip to main content
FnUser
New Member
December 14, 2021
Question

Test request for IPS signature (CVE-2021-44228)

  • December 14, 2021
  • 3 replies
  • 7481 views

Does anybody knows how to trigger IPS signature for CVE-2021-44228? Sample of the test request would be nice.

3 replies

jdelafuente_FTNT
Staff & Editor
Staff & Editor
December 14, 2021

Hello, here is some information related:

https://www.fortiguard.com/outbreak-alert/log4j2-vulnerability

 

1. Security Profiles/Intrusion Prevention/ <IPS profile name>/Edit
2. IPS Signatures and Filters/Create New
3. Type-Signature/Action-Block/Status-Enable/ search-apache.log (then clic in search icon)
4. Select (clic) "Apache.Log4j.Error.Log.Remote.Code.Executio.." - add Selected - clic OK
5. Put this new entry on top (drop it)
6. Clic OK

Add New signature for Apache vulnAdd New signature for Apache vulnputit on topputit on top

FnUser
FnUserAuthor
New Member
December 14, 2021

I have no problem to activate it, how can I test it to make sure it works? 

zeki893
New Member
December 14, 2021
FnUser
FnUserAuthor
New Member
December 14, 2021

Didn't trigger on IPSDidn't trigger on IPS