Test request for IPS signature (CVE-2021-44228)

[FnUser]

Does anybody knows how to trigger IPS signature for CVE-2021-44228? Sample of the test request would be nice.

[jdelafuente_FTNT]

Hello, here is some information related:

https://www.fortiguard.com/outbreak-alert/log4j2-vulnerability

1. Security Profiles/Intrusion Prevention/ <IPS profile name>/Edit
2. IPS Signatures and Filters/Create New
3. Type-Signature/Action-Block/Status-Enable/ search-apache.log (then clic in search icon)
4. Select (clic) "Apache.Log4j.Error.Log.Remote.Code.Executio.." - add Selected - clic OK
5. Put this new entry on top (drop it)
6. Clic OK

Add New signature for Apache vulnputit on top

[FnUser]

I have no problem to activate it, how can I test it to make sure it works? 

[jdelafuente_FTNT]

May this help.

https://www.picussecurity.com/resource/blog/simulating-and-preventing-cve-2021-44228-apache-log4j-rc...

[zeki893]

You can try this method:

https://twitter.com/ThinkstCanary/status/1469439743905697797?s=20

[FnUser]

Didn't trigger on IPS