Vulnerabilidad Info Pago

{
  "afectados": [
    {
      "corregida_en": [
        "38513a7d57343881f7bf58f37e67d6a87e0a47c5",
        "ad361d2e517e765f69db464d9407ac2dd80bc93e"
      ],
      "ecosistema": null,
      "paquete": null
    }
  ],
  "alias": [
    "GHSA-jfh8-c2jp-5v3q"
  ],
  "cvss": [
    "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  ],
  "descripcion": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message p…",
  "fuente": "OSV.dev (CC BY 4.0)",
  "gravedad": null,
  "id": "CVE-2021-44228",
  "modificada": "2026-08-13T04:01:09.237466383Z",
  "publicada": "2021-12-10T10:15:09.143Z",
  "referencias": [
    "https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md",
    "http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html"
  ],
  "resumen": null
}

# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i -X POST 'https://api.vextorium.com/vulnerabilidad-info-pago' \
  -H 'content-type: application/json' \
  --data-raw '{"identificador":"CVE-2021-44228"}'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - -X POST 'https://api.vextorium.com/vulnerabilidad-info-pago' \
  -H 'content-type: application/json' \
  --data-raw '{"identificador":"CVE-2021-44228"}' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.003 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.003" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.003 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fapi.vextorium.com%2Fvulnerabilidad-info-pago&method=POST
const res = await pay("https://api.vextorium.com/vulnerabilidad-info-pago", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "identificador": "CVE-2021-44228"
  }),
});
console.log(res.status, await res.text());

# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.003 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.003"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.post(
        "https://api.vextorium.com/vulnerabilidad-info-pago",
        json={
            "identificador": "CVE-2021-44228",
        },
    )
    print(res.status_code, res.text)