Vuln Cve

{
  "cvss": {
    "score": 10,
    "severity": "CRITICAL",
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
    "version": "3.1"
  },
  "cwes": [
    "CWE-502",
    "CWE-400",
    "CWE-20"
  ],
  "exploitation": {
    "epss": {
      "percentile": 1,
      "probability_30d": 0.99999
    },
    "kev": {
      "added": "2021-12-10",
      "ransomware_use": true
    },
    "known_exploited": true
  },
  "found": true,
  "id": "CVE-2021-44228",
  "packages": [
    {
      "ecosystem": "Maven",
      "fixed_in": [
        "2.15.0"
      ],
      "name": "org.apache.logging.log4j:log4j-core"
    }
  ],
  "priority": "patch now",
  "state": "PUBLISHED",
  "title": "Apache Log4j2 JNDI features do not protect against attacker controlled LDAP"
}

# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i 'https://saylorinnovations.com/api/vuln/cve?id=CVE-2021-44228'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - 'https://saylorinnovations.com/api/vuln/cve?id=CVE-2021-44228' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.01 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.01" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.01 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fsaylorinnovations.com%2Fapi%2Fvuln%2Fcve
const res = await pay("https://saylorinnovations.com/api/vuln/cve?id=CVE-2021-44228");
console.log(res.status, await res.text());

# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.01 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.01"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.get("https://saylorinnovations.com/api/vuln/cve?id=CVE-2021-44228")
    print(res.status_code, res.text)