You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+39-35
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
<h1>Log4-detector</h1>
4
4
5
-
Scanner that detects vulnerable Log4J versions to help teams assess their exposure to [CVE-2021-44228](https://mergebase.com/vulnerability/CVE-2021-44228/), [CVE-2021-45046](https://mergebase.com/vulnerability/CVE-2021-45046/) and [CVE-2021-45105](https://mergebase.com/vulnerability/CVE-2021-45105/). Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It is able to find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!
5
+
Scanner that detects vulnerable Log4J versions to help teams assess their exposure to **[CVE-2021-44228](https://mergebase.com/vulnerability/CVE-2021-44228/) (CRITICAL)**, [CVE-2021-45046](https://mergebase.com/vulnerability/CVE-2021-45046/), [CVE-2021-45105](https://mergebase.com/vulnerability/CVE-2021-45105/), and [CVE-2021-44832](https://mergebase.com/vulnerability/CVE-2021-44832/). Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It is able to find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!
6
6
7
7
# Table of Contents
8
8
-[Introduction](#itemdetector)
@@ -26,7 +26,7 @@ Scanner that detects vulnerable Log4J versions to help teams assess their exposu
26
26
27
27
# Introduction <aname="itemdetector"></a>
28
28
29
-
Currently reports [log4j-core](https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/) versions 2.3.1, 2.12.3, and 2.17.0 as **\_SAFE\_**, 2.12.2, 2.15.0and 2.16.0 as **\_OKAY\_** and all other versions as **\_VULNERABLE\_**
29
+
Currently reports [log4j-core](https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/) versions 2.3.2, 2.12.4, and 2.17.1 as **\_SAFE\_**, 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0 as **\_OKAY\_** and all other versions as **\_VULNERABLE\_**
30
30
(although it does report pre-2.0-beta9 as **\_POTENTIALLY_SAFE\_**). It reports older [log4j-1.x](https://repo1.maven.org/maven2/log4j/log4j/) versions as **\_OLD\_**.
31
31
32
32
Can correctly detect log4j inside executable spring-boot jars/wars, dependencies blended
@@ -35,48 +35,49 @@ exploded jar files just sitting uncompressed on the file-system (aka *.class).
35
35
36
36
We currently maintain a collection of [log4j-samples](https://github.com/mergebase/log4j-samples) we use for testing.
old-hits/log4j-core-2.0-beta2.jar contains Log4J-2.x <= 2.0-beta8 _POTENTIALLY_SAFE_ (Did you remove JndiLookup.class?)
71
72
```
72
73
73
74
# Understanding The Results <aname="itemresults"></a>
74
75
75
76
**\_VULNERABLE\_** -> You need to upgrade or remove this file.
76
77
77
-
**\_OKAY\_** -> We only report this for Log4J versions 2.12.2, 2.15.0, and 2.16.0. We recommend upgrading to 2.17.0.
78
+
**\_OKAY\_** -> We report this for Log4J versions 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0. We recommend upgrading to 2.17.1.
78
79
79
-
**\_SAFE\_** -> We currently only report this for Log4J versions 2.3.1, 2.12.3, and 2.17.0 (and greater).
80
+
**\_SAFE\_** -> We currently only report this for Log4J versions 2.3.2, 2.12.4, and 2.17.1 (and greater).
80
81
81
82
**\_OLD\_** -> You are safe from CVE-2021-44228, but should plan to upgrade because Log4J 1.2.x has been EOL for 7 years and has several known-vulnerabilities.
@@ -130,6 +131,9 @@ on your file-system, it then examines that file for this String: "Invalid JNDI U
130
131
literal is only present in the patched version of Log4J (version 2.15.0). Any versions of Log4J without that String are
131
132
vulnerable.
132
133
134
+
This same technique of examining *.class files for String literals is further extended to accurately detect safe
135
+
versions 2.3.2, 2.12.4, and 2.17.1.
136
+
133
137
## This Scanner Only Reports Hits Against The `log4j-core` Library. What About `log4j-api`? <aname="itemapi"></a>
134
138
135
139
Many scanners (including GitHub's own [Dependabot](https://github.com/dependabot)) currently report both "`log4j-core`" and "`log4j-api`" libraries as vulnerable. These scanners are incorrect. There is currently no existing version of the "`log4j-api`" library that can be exploited by any of these vulnerabilities.
@@ -145,8 +149,8 @@ Version 2.12.2 is important because it's a Java 7 compatible version of Log4J th
145
149
146
150
Versions 2.15.0 and 2.16.0 are important because these are the first versions where Log4J's default out-of-the-box configuration is not vulnerable to CVE-2021-44228.
147
151
148
-
And versions 2.3.1, 2.12.3, and 2.17.0 are important because they are not vulnerable to more recently discovered CVEs such as CVE-2021-45046 and CVE-2021-45105.
149
-
Despite these being much less serious vulnerabilities, we anticipate everyone will want to patch to one of 2.3.1, 2.12.3, or 2.17.0.
152
+
And versions 2.3.2, 2.12.4, and 2.17.1 are important because they are not vulnerable to more recently discovered CVEs such as CVE-2021-45046 and CVE-2021-45105.
153
+
Despite these being much less serious vulnerabilities, we anticipate everyone will want to patch to one of 2.3.2, 2.12.4, or 2.17.1.
150
154
151
155
## What are those "file1.war!/path/to/file2.zip!/path/to/file3.jar!/path/to/log4j.jar" results about? <aname="itemwar"></a>
152
156
@@ -168,7 +172,7 @@ Only versions of Log4J 2.x (from 2.0-beta9 to 2.14.1) are vulnerable to CVE-2021
168
172
169
173
## How Can I Be Sure This Isn't A Trojan Pretending To Be A Log4J Detector? <aname="itemtrojan"></a>
170
174
171
-
Great question! Since we include the complete source code here in Github (all 2200 lines of Java), as well as the steps
175
+
Great question! Since we include the complete source code here in Github (all 2500 lines of Java), as well as the steps
172
176
to build it, and since this tool has zero dependencies, it shouldn't take too long to carefully study the code to your
173
177
satisfaction. If you don't trust Maven you can go directly into the "src/main/java/com/mergebase/log4j" directory and
0 commit comments