Original Script and Repo: https://github.com/CERTCC/CVE-2021-44228_scanner
Modified by: Alex Pena
Applications that are vulnerable to the log4j CVE-2021-44228 issue may be detectable by scanning jar, war, and ear files to search for the presence of JndiLookup.class
.
Any file discovered is worth investigation to determine if the application using it is vulnerable. For any JndiLookup.class
that is present, log4j commonly includes the version in the jar file name. For example, a hit on log4j-core-2.14.1.jar
would be indicative of a vulnerable application. Alternatively, log4j-core-2.16.jar
may also produce a hit because the JndiLookup code is still present in the 2.16 version of log4j, but it is disabled by default. See VU#930724 for more details.
Parameters
-Force Allow scanning of system and hidden files (The Force parameter doesn't override security restrictions)
-Verbose Extra scanning output and messages
Scan current directory
.\checkjndi.ps1
Scan test_folder
directory, with extra output and scanning system/hidden files
.\checkjndi.ps1 -Force -Verbose c:\Users\alex\Desktop\test_folder
For example, here is an invocation of the PowerShell version of the scanner:
Locations to scan can be piped into the script to have control of what is checked. For example, to scan a list of paths conatined in a the file paths.txt
:
get-content .\paths.txt | .\checkjndi.ps1
Let's look at the first hit on our Windows scan execution:
C:\Users\unst0\Desktop\test_folder\apache-log4j-2.17.1-bin.zip contains apache-log4j-2.17.1-bin/log4j-core-2.17.1.jar contains org/apache/logging/log4j/core/lookup/JndiLookup.class ** BUT APPEARS TO BE PATCHED **
This jar file contains a 2.17 version of log4j, which is not vulnerable to CVE-2021-44228. This result is reported for information purposes, which shows that a vendor has patched their product.
Let's look at the second hit:
WARNING: C:\Users\unst0\Desktop\test_folder\ghidra_10.0.4_PUBLIC_20210928.zip contains ghidra_10.0.4_PUBLIC/Ghidra/Framework/Generic/lib/log4j-core-2.12.1.jar contains org/apache/logging/log4j/core/lookup/JndiLookup.class
Here we can see that Ghidra uses log4j version 2.12.1, and as such we should assume it to be vulnerable. And indeed, Ghidra versions before 10.1 are vulnerable to CVE-2021-44228.
Let's look at the third hit:
WARNING: C:\Users\unst0\Desktop\test_folder\server.jar contains META-INF/libraries/org/apache/logging/log4j/log4j-core/2.14.1/log4j-core-2.14.1.jar contains org/apache/logging/log4j/core/lookup/JndiLookup.class
Here we can see that the minecraft server.jar file uses log4j version 2.14.1, and as such we should assume it to be vulnerable. And indeed, Minecraft: Java Edition server versions before 1.18.1 are vulnerable to CVE-2021-44228.
You should investigate any hits reported by either of these scripts, and confirm that either the log4j version is indeed the fixed 2.16 version, or reach out to your software vendor to obtain a fixed version of the software. Alternatively, VU#930724 has information about how JndiLookup.class
can be removed from vulnerable jar files.
The PowerShell version of the scanner has additional error reporting when files or directories cannot be investigated. In particular, any Unable to scan
errors reporting UnauthorizedAccessException
is indicative of a permission problem in accessing a directory and/or a file. Any Unable to scan
errors reporting InvalidDataException
is usually due to a corrupt archive.