Fixed some mitigated files not detected. #197

Author: xeraph

src/main/java/com/logpresso/scanner/Detector.java

@@ -37,11 +37,14 @@ public class Detector {
 	private static final String LOG4J_12_CORE_POM_PROPS = "META-INF/maven/log4j/log4j/pom.properties";
 	private static final String LOG4J_12_JMSAPPENDER = "org/apache/log4j/net/JMSAppender.class";
 	private static final String LOG4J_12_JMSAPPENDER_SHADE_PATH = "/log4j/net/JMSAppender.class";
+	private static final String LOG4J_12_JMSSINK = "org/apache/log4j/net/JMSSink.class";
+	private static final String LOG4J_12_JMSSINK_SHADE_PATH = "/log4j/net/JMSSink.class";
 
 	// CVE-2021-42550 (published at 2021-12-16): vulnerable if version <= 1.2.7
 	// logback 1.2.9 moved JNDIUtil.class to core package
 	private static final String LOGBACK_CLASSIC_POM_PROPS = "META-INF/maven/ch.qos.logback/logback-classic/pom.properties";
 	private static final String LOGBACK_JNDI_CLASS_PATH = "ch/qos/logback/classic/util/JNDIUtil.class";
+	private static final String LOGBACK_ENV_CLASS_PATH = "ch/qos/logback/classic/util/EnvUtil.class";
 
 	private Configuration config;
 
@@ -202,9 +205,11 @@ private DetectResult scanStream(File jarFile, ZipFileIterator it, List<String> p
 
 		// log4j1 class
 		boolean foundJmsAppender = false;
+		boolean foundJmsSink = false;
 
 		// logback class
 		boolean foundJndiUtil = false;
+		boolean foundEnvUtil = false;
 
 		// shade class
 		Set<String> shadedJndiLookupPaths = new TreeSet<String>();
@@ -218,7 +223,7 @@ private DetectResult scanStream(File jarFile, ZipFileIterator it, List<String> p
 
 				InputStream is = it.getNextInputStream();
 				if (entry.getName().equals(LOG4J_CORE_POM_PROPS))
-					log4j2Version = loadVulnerableLog4jVersion(is);
+					log4j2Version = loadLog4j2Version(is);
 
 				if (entry.getName().equals(JNDI_LOOKUP_CLASS_PATH))
 					log4j2Mitigated = false;
@@ -228,21 +233,30 @@ private DetectResult scanStream(File jarFile, ZipFileIterator it, List<String> p
 
 				if (config.isScanForLog4j1()) {
 					if (entry.getName().equals(LOG4J_12_CORE_POM_PROPS))
-						log4j1Version = loadVulnerableLog4j1(is);
+						log4j1Version = loadLog4j1Version(is);
 
 					if (entry.getName().equals(LOG4J_12_JMSAPPENDER))
 						foundJmsAppender = true;
 
+					if (entry.getName().equals(LOG4J_12_JMSSINK))
+						foundJmsSink = true;
+
 					if (entry.getName().endsWith(LOG4J_12_JMSAPPENDER_SHADE_PATH))
 						shadedJmsAppenderPaths.add(entry.getName());
+
+					if (entry.getName().endsWith(LOG4J_12_JMSSINK_SHADE_PATH))
+						foundJmsSink = true;
 				}
 
 				if (config.isScanForLogback()) {
 					if (entry.getName().equals(LOGBACK_CLASSIC_POM_PROPS))
-						logbackVersion = loadVulnerableLogback(is);
+						logbackVersion = loadLogbackVersion(is);
 
 					if (entry.getName().equals(LOGBACK_JNDI_CLASS_PATH))
 						foundJndiUtil = true;
+
+					if (entry.getName().equals(LOGBACK_ENV_CLASS_PATH))
+						foundEnvUtil = true;
 				}
 
 				if (ZipUtils.isScanTarget(entry.getName(), config.isScanZip())) {
@@ -275,26 +289,36 @@ private DetectResult scanStream(File jarFile, ZipFileIterator it, List<String> p
 				result.setPotentiallyVulnerableLog4j2();
 			}
 
-			if (log4j1Version != null) {
-				printDetectionForLog4j1(jarFile, pathChain, log4j1Version, !foundJmsAppender);
-				if (foundJmsAppender)
-					result.setPotentiallyVulnerableLog4j1();
+			boolean log4j1Found = log4j1Version != null || foundJmsAppender || foundJmsSink;
+			boolean log4j1Mitigated = !foundJmsAppender;
+			log4j1Mitigated &= shadedJmsAppenderPaths.isEmpty();
+
+			if (log4j1Found) {
+				if (log4j1Version != null)
+					printDetectionForLog4j1(jarFile, pathChain, log4j1Version, log4j1Mitigated);
 				else
+					printDetectionForLog4j1(jarFile, pathChain, POTENTIALLY_VULNERABLE, log4j1Mitigated);
+
+				if (log4j1Mitigated)
 					result.setMitigated();
-			} else if (foundJmsAppender) {
-				printDetectionForLog4j1(jarFile, pathChain, POTENTIALLY_VULNERABLE, false);
-				result.setPotentiallyVulnerableLog4j1();
+				else
+					result.setPotentiallyVulnerableLog4j1();
 			}
 
-			if (logbackVersion != null) {
-				printDetectionForLogback(jarFile, pathChain, logbackVersion, !foundJndiUtil);
-				if (foundJndiUtil)
-					result.setPotentiallyVulnerableLogback();
-				else
+			boolean logbackFound = isVulnerableLogback(logbackVersion, foundJndiUtil, foundEnvUtil);
+			boolean logbackMitigated = !foundJndiUtil;
+
+			if (logbackFound) {
+				if (logbackVersion != null) {
+					printDetectionForLogback(jarFile, pathChain, logbackVersion, logbackMitigated);
+				} else {
+					printDetectionForLogback(jarFile, pathChain, POTENTIALLY_VULNERABLE, logbackMitigated);
+				}
+
+				if (logbackMitigated)
 					result.setMitigated();
-			} else if (foundJndiUtil) {
-				printDetectionForLogback(jarFile, pathChain, POTENTIALLY_VULNERABLE, false);
-				result.setPotentiallyVulnerableLogback();
+				else
+					result.setPotentiallyVulnerableLogback();
 			}
 
 			return result;
@@ -307,6 +331,17 @@ private DetectResult scanStream(File jarFile, ZipFileIterator it, List<String> p
 		}
 	}
 
+	private boolean isVulnerableLogback(String logbackVersion, boolean foundJndiUtil, boolean foundEnvUtil) {
+		boolean logbackFound = false;
+		if (logbackVersion != null) {
+			if (isVulnerableLogback(Version.parse(logbackVersion)))
+				logbackFound = true;
+		} else {
+			logbackFound = foundJndiUtil || foundEnvUtil;
+		}
+		return logbackFound;
+	}
+
 	private boolean isWinRarFile(File jarFile, List<String> pathChain) {
 		String fileName = null;
 		if (pathChain.isEmpty())
@@ -317,7 +352,7 @@ private boolean isWinRarFile(File jarFile, List<String> pathChain) {
 		return fileName.toLowerCase().endsWith(".rar");
 	}
 
-	private String loadVulnerableLog4jVersion(InputStream is) throws IOException {
+	private String loadLog4j2Version(InputStream is) throws IOException {
 		Properties props = new Properties();
 		props.load(is);
 
@@ -331,26 +366,22 @@ private String loadVulnerableLog4jVersion(InputStream is) throws IOException {
 		return null;
 	}
 
-	private String loadVulnerableLog4j1(InputStream is) throws IOException {
+	private String loadLog4j1Version(InputStream is) throws IOException {
 		Properties props = new Properties();
 		props.load(is);
-
 		return props.getProperty("version");
 	}
 
-	private String loadVulnerableLogback(InputStream is) throws IOException {
+	private String loadLogbackVersion(InputStream is) throws IOException {
 		Properties props = new Properties();
 		props.load(is);
 
 		String groupId = props.getProperty("groupId");
 		String artifactId = props.getProperty("artifactId");
 		String version = props.getProperty("version");
 
-		if (groupId.equals("ch.qos.logback") && artifactId.equals("logback-classic")) {
-			Version v = Version.parse(version);
-			if (isVulnerableLogback(v))
-				return version;
-		}
+		if (groupId.equals("ch.qos.logback") && artifactId.equals("logback-classic"))
+			return version;
 
 		return null;
 	}