Skip to content

Commit 4a4d034

Browse files
committed
Detect also shaded Log4j2, Log4j1 JAR files. v2.3.0
1 parent f260b46 commit 4a4d034

File tree

7 files changed

+225
-258
lines changed

7 files changed

+225
-258
lines changed

README.md

+6-6
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,14 @@
33
log4j2-scan is a single binary command-line tool for CVE-2021-44228 vulnerability scanning and mitigation patch. It also supports nested JAR file scanning and patch. It also detects CVE-2021-45046 (log4j 2.15.0), CVE-2021-45105 (log4j 2.16.0), CVE-2021-4104 (log4j 1.x), and CVE-2021-42550 (logback 0.9-1.2.7) vulnerabilities.
44

55
### Download
6-
* [log4j2-scan 2.2.2 (Windows x64, 7z)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.2.2/logpresso-log4j2-scan-2.2.2-win64.7z)
7-
* [log4j2-scan 2.2.2 (Windows x64, zip)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.2.2/logpresso-log4j2-scan-2.2.2-win64.zip)
6+
* [log4j2-scan 2.3.0 (Windows x64, 7z)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.3.0/logpresso-log4j2-scan-2.3.0-win64.7z)
7+
* [log4j2-scan 2.3.0 (Windows x64, zip)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.3.0/logpresso-log4j2-scan-2.3.0-win64.zip)
88
* If you get `VCRUNTIME140.dll not found` error, install [Visual C++ Redistributable](https://docs.microsoft.com/en-US/cpp/windows/latest-supported-vc-redist?view=msvc-170).
99
* If native executable doesn't work, use the JAR instead. 32bit is not supported.
1010
* 7zip is available from www.7zip.org, and is open source and free.
11-
* [log4j2-scan 2.2.2 (Linux x64)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.2.2/logpresso-log4j2-scan-2.2.2-linux.tar.gz)
11+
* [log4j2-scan 2.3.0 (Linux x64)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.3.0/logpresso-log4j2-scan-2.3.0-linux.tar.gz)
1212
* If native executable doesn't work, use the JAR instead. 32bit is not supported.
13-
* [log4j2-scan 2.2.2 (Any OS, 20KB)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.2.2/logpresso-log4j2-scan-2.2.2.jar)
13+
* [log4j2-scan 2.3.0 (Any OS, 20KB)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.3.0/logpresso-log4j2-scan-2.3.0.jar)
1414

1515
### Build
1616
* [How to build Native Image](https://github.com/logpresso/CVE-2021-44228-Scanner/wiki/FAQ#how-to-build-native-image)
@@ -20,7 +20,7 @@ Just run log4j2-scan.exe or log4j2-scan with target directory path. The logpress
2020

2121
Usage
2222
```
23-
Logpresso CVE-2021-44228 Vulnerability Scanner 2.2.2 (2021-12-18)
23+
Logpresso CVE-2021-44228 Vulnerability Scanner 2.3.0 (2021-12-18)
2424
Usage: log4j2-scan [--fix] target_path1 target_path2
2525
2626
-f [config_file_path]
@@ -81,7 +81,7 @@ On Linux
8181
```
8282
On UNIX (AIX, Solaris, and so on)
8383
```
84-
java -jar logpresso-log4j2-scan-2.2.2.jar [--fix] target_path
84+
java -jar logpresso-log4j2-scan-2.3.0.jar [--fix] target_path
8585
```
8686

8787
If you add `--fix` option, this program will copy vulnerable original JAR file to .bak file, and create new JAR file without `org/apache/logging/log4j/core/lookup/JndiLookup.class` entry. In most environments, JNDI lookup feature will not be used. However, you must use this option at your own risk. Depending the Operating System:

pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<modelVersion>4.0.0</modelVersion>
77
<groupId>com.logpresso</groupId>
88
<artifactId>log4j2-scanner</artifactId>
9-
<version>2.2.2</version>
9+
<version>2.3.0</version>
1010
<packaging>jar</packaging>
1111
<name>Logpresso Log4j2 Scanner</name>
1212

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
package com.logpresso.scanner;
2+
3+
public class DetectResult {
4+
private boolean vulnerable = false;
5+
private boolean mitigated = false;
6+
private boolean potentiallyVulnerableLog4j2 = false;
7+
private boolean potentiallyVulnerableLog4j1 = false;
8+
private boolean potentiallyVulnerableLogback = false;
9+
private boolean nestedJar = false;
10+
11+
public void merge(DetectResult result) {
12+
vulnerable |= result.isVulnerable();
13+
mitigated |= result.isMitigated();
14+
potentiallyVulnerableLog4j1 |= result.isPotentiallyVulnerableLog4j1();
15+
potentiallyVulnerableLog4j2 |= result.isPotentiallyVulnerableLog4j2();
16+
potentiallyVulnerableLogback |= result.isPotentiallyVulnerableLogback();
17+
}
18+
19+
public boolean isVulnerable() {
20+
return vulnerable;
21+
}
22+
23+
public void setVulnerable() {
24+
this.vulnerable = true;
25+
}
26+
27+
public boolean isMitigated() {
28+
return mitigated;
29+
}
30+
31+
public void setMitigated() {
32+
this.mitigated = true;
33+
}
34+
35+
public boolean isPotentiallyVulnerableLog4j2() {
36+
return potentiallyVulnerableLog4j2;
37+
}
38+
39+
public void setPotentiallyVulnerableLog4j2() {
40+
this.potentiallyVulnerableLog4j2 = true;
41+
}
42+
43+
public boolean isPotentiallyVulnerableLog4j1() {
44+
return potentiallyVulnerableLog4j1;
45+
}
46+
47+
public void setPotentiallyVulnerableLog4j1() {
48+
this.potentiallyVulnerableLog4j1 = true;
49+
}
50+
51+
public boolean isPotentiallyVulnerableLogback() {
52+
return potentiallyVulnerableLogback;
53+
}
54+
55+
public void setPotentiallyVulnerableLogback() {
56+
this.potentiallyVulnerableLogback = true;
57+
}
58+
59+
public boolean hasNestedJar() {
60+
return nestedJar;
61+
}
62+
63+
public void setNestedJar(boolean nestedJar) {
64+
this.nestedJar |= nestedJar;
65+
}
66+
67+
public Status getStatus() {
68+
if (vulnerable)
69+
return Status.VULNERABLE;
70+
else if (mitigated)
71+
return Status.MITIGATED;
72+
else if (isPotentiallyVulnerable())
73+
return Status.POTENTIALLY_VULNERABLE;
74+
return Status.NOT_VULNERABLE;
75+
}
76+
77+
public boolean isPotentiallyVulnerable() {
78+
return potentiallyVulnerableLog4j2 || potentiallyVulnerableLog4j1 || potentiallyVulnerableLogback;
79+
}
80+
81+
public boolean isFixRequired() {
82+
// Don't touch potentially vulnerable log4j2
83+
return vulnerable || potentiallyVulnerableLog4j1 || potentiallyVulnerableLogback;
84+
}
85+
}

0 commit comments

Comments
 (0)