Log4-detectorLog4J 漏洞版本扫描器

联合创作 · 2023-09-26 21:57

Log4-detector 是一个可以在任何应用程序中的文件系统上检测易受攻击的 Log4J 版本(CVE-2021-44228、CVE-2021-45046 等)的扫描程序。

甚至能够找到隐藏在几层深处的 Log4J 实例。适用于 Linux、Windows 和 Mac,也适用于 Java 运行的其他任何地方。

用法

java -jar log4j-detector-2021.12.22.jar 

Usage: java -jar log4j-detector-2021.12.22.jar [--verbose] [--json] [--stdin] [--exclude=X] [paths to scan...]

  --json       - Output STDOUT results in JSON.  (Errors/warning still emitted to STDERR)
  --stdin      - Read STDIN for paths to explore (one path per line)
  --exclude=X  - Where X is a JSON list containing full paths to exclude. Must be valid JSON.

                 Example: --exclude='["/dev", "/media", "Z:\TEMP"]'

Exit codes:  0 = No vulnerable Log4J versions found.
             1 = At least one legacy Log4J 1.x version found.
             2 = At least one vulnerable Log4J version found.

About - MergeBase log4j detector (version 2021.12.22)
Docs  - https://github.com/mergebase/log4j-detector 
(C) Copyright 2021 Mergebase Software Inc. Licensed to you via GPLv3.

示例

java -jar log4j-detector-2021.12.22.jar [path-to-scan] > hits.txt

更多示例

java -jar log4j-detector-2021.12.22.jar ./samples 

-- github.com/mergebase/log4j-detector v2021.12.22 (by mergebase.com) analyzing paths (could take a while).
-- Note: specify the '--verbose' flag to have every file examined printed to STDERR.
/opt/mergebase/log4j-detector/samples/clt-1.0-SNAPSHOT.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/infinispan-embedded-query-8.2.12.Final.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-1.1.3.jar contains Log4J-1.x   <= 1.2.17 _OLD_
/opt/mergebase/log4j-detector/samples/log4j-1.2.13.jar contains Log4J-1.x   <= 1.2.17 _OLD_
/opt/mergebase/log4j-detector/samples/log4j-1.2.17.jar contains Log4J-1.x   <= 1.2.17 _OLD_
/opt/mergebase/log4j-detector/samples/log4j-core-2.0-beta2.jar contains Log4J-2.x   <= 2.0-beta8 _POTENTIALLY_SAFE_ (or did you already remove JndiLookup.class?) 
/opt/mergebase/log4j-detector/samples/log4j-core-2.0-beta9.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.0.2.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.0.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.10.0.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.12.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.12.2.jar contains Log4J-2.x   == 2.12.2 _OKAY_
/opt/mergebase/log4j-detector/samples/log4j-core-2.12.3.jar contains Log4J-2.x   >= 2.12.3 _SAFE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.14.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.15.0.jar contains Log4J-2.x   == 2.15.0 _OKAY_
/opt/mergebase/log4j-detector/samples/log4j-core-2.16.0.jar contains Log4J-2.x   == 2.16.0 _OKAY_
/opt/mergebase/log4j-detector/samples/log4j-core-2.17.0.jar contains Log4J-2.x   >= 2.17.0 _SAFE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.3.1.jar contains Log4J-2.x   == 2.3.1 _SAFE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.4.1.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.9.1.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_

扫描结果

Log4-detector 会将 log4j-core 版本 2.3.1、2.12.3 和 2.17.0 报告为 _SAFE_ ,将2.12.2、2.15.0和 2.16.0 报告为_OKAY_,将所有其他版本 报告为 _VULNERABLE_,将旧的log4j-1.x版本报告为 _OLD_

可以正确检测可执行 spring-boot jars/wars 中的 log4j、混合到 uber jars 中的依赖项、shaded jars,甚至是未压缩的jar 文件(又名*.class)。

  • _VULNERABLE_ -> 需要升级或删除此文件。
  • _OKAY_ -> 仅针对 Log4J 版本 2.12.2、2.15.0 和 2.16.0 报告此问题,建议升级到 2.17.0。
  • _SAFE_ -> 目前仅针对 Log4J 版本 2.3.1、2.12.3 和 2.17.0(及更高版本)报告此问题。
  • _OLD_ -> 可以免受 CVE-2021-44228 的影响,但应该计划升级,因为 Log4J 1.2.x 已经停产 7 年并且有几个已知的漏洞。
  • _POTENTIALLY_SAFE_ -> “JndiLookup.class”文件不存在,要么是因为您的 Log4J 版本很旧(2.0-beta9 之前),要么因为有人已经删除了这个文件。如果是这种情况,请确保是团队或公司的成员删除“JndiLookup.class”,因为攻击者会自己删除此文件,以防止其他竞争攻击者获得对受感染系统的访问权限。
浏览 6
点赞
评论
收藏
分享

手机扫一扫分享

编辑 分享
举报
评论
图片
表情
推荐
点赞
评论
收藏
分享

手机扫一扫分享

编辑 分享
举报