Acme Corp — External Penetration Test
Acme Corp
Executive Summary
Identify and demonstrate the impact of security weaknesses in Acme Corp's external attack surface and customer portal, and provide prioritized, actionable remediation guidance.
- Apache Log4j2 remote code execution (Log4Shell) — CVE-2021-44228
Remediation Priorities
- Critical Apache Log4j2 remote code execution (Log4Shell) — Upgrade Log4j2 to a fixed release.
- Critical Authentication bypass on admin portal — Enforce server-side auth + MFA.
- High SQL injection in portal login — Use parameterized queries.
- Medium Server supports deprecated TLS 1.0/1.1 — Disable TLS 1.0/1.1.
Summary of Findings
| # | Finding | Severity | CVSS |
|---|---|---|---|
| 1 | Apache Log4j2 remote code execution (Log4Shell) | Critical | — |
| 2 | Authentication bypass on admin portal | Critical | — |
| 3 | SQL injection in portal login | High | — |
| 4 | Server supports deprecated TLS 1.0/1.1 | Medium | — |
| 5 | SPF record allows soft-fail (~all) | Low | — |
Detailed Findings
1. Apache Log4j2 remote code execution (Log4Shell)
⚠ Actively exploited — on the CISA KEV catalog
CVE-2021-44228 — Apache Log4j2 Remote Code Execution (Log4Shell)
MITRE ATT&CK: T1190 Exploit Public-Facing Application T1059 Command and Scripting Interpreter
Unpatched Log4j2 on the public web tier permits unauthenticated RCE.
Upgrade Log4j2 to a fixed release.
2. Authentication bypass on admin portal
MITRE ATT&CK: T1190 Exploit Public-Facing Application T1078 Valid Accounts
The admin console is reachable unauthenticated.
Enforce server-side auth + MFA.
3. SQL injection in portal login
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Injectable login parameter.
Use parameterized queries.
4. Server supports deprecated TLS 1.0/1.1
Weak TLS on the perimeter.
Disable TLS 1.0/1.1.
5. SPF record allows soft-fail (~all)
Spoofable domain.
Appendix: MITRE ATT&CK Coverage
Techniques demonstrated during the assessment, grouped by tactic.
| Tactic | Technique | Findings |
|---|---|---|
| Initial Access | T1078 Valid Accounts | Authentication bypass on admin portal |
| Initial Access | T1190 Exploit Public-Facing Application | Apache Log4j2 remote code execution (Log4Shell); Authentication bypass on admin portal; SQL injection in portal login |
| Execution | T1059 Command and Scripting Interpreter | Apache Log4j2 remote code execution (Log4Shell) |
Methodology
Reconnaissance → enumeration → vulnerability analysis → controlled exploitation (where authorized) → post-exploitation assessment → reporting. Aligned to PTES and OWASP WSTG.