diff --git a/README.md b/README.md index 49dd780..050b733 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,13 @@ CVE-2021-44228 found declared as dependency in META-INF/maven/org.apache.logging CVE-2021-44228 found in class file org/apache/logging/log4j/core/net/JndiManager$1.class ``` +## How to run this tool on a live server (no need to stop your running Java instances) + +1. Download the [jar file](https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector/releases/download/v0.5/Log4JDetector-0.5-jar-with-dependencies.jar) under releases. +2. Run `java -cp de.codeshield.log4jshell.Log4JProcessDetector` +3. The jar searches the classpath of all running java processes for vulnerable log4j instances + + ## Background on CVE-2021-44228 A serious Remote Code Execution vulnerability has been discovered within log4j and version 2.0-beta9 to 2.14 are affected. The vulnerability has been classified as critical, as it affected log4j one of the most used logging libraries for Java. There are many references and article out there. diff --git a/pom.xml b/pom.xml index 49e01a2..7bf7738 100644 --- a/pom.xml +++ b/pom.xml @@ -1,126 +1,132 @@ - 4.0.0 + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> + 4.0.0 - de.codeshield.log4shell - Log4JDetector - 0.4 + de.codeshield.log4shell + Log4JDetector + 0.4 - cve-2021-44228-detector - https://codeshield.io + cve-2021-44228-detector + https://codeshield.io - - UTF-8 - 1.7 - 1.7 - + + UTF-8 + 1.8 + 1.8 + - - - junit - junit - 4.13.1 - test - - - org.apache.maven - maven-model - 3.8.4 - - - commons-io - commons-io - 2.11.0 - - - - org.apache.maven - maven-project - 2.2.1 - - - - commons-codec - commons-codec - 1.15 - + + + junit + junit + 4.13.1 + test + + + org.apache.maven + maven-model + 3.8.4 + + + commons-io + commons-io + 2.11.0 + + + + org.apache.maven + maven-project + 2.2.1 + + + + commons-codec + commons-codec + 1.15 + - - com.opencsv - opencsv - 5.5.2 - - + + com.opencsv + opencsv + 5.5.2 + + + commons-lang + commons-lang + 2.6 + compile + + - - - - maven-assembly-plugin - - - - de.codeshield.log4jshell.Log4JDetector - - - - jar-with-dependencies - - - - - org.apache.maven.plugins - maven-compiler-plugin - - 8 - 8 - - - - - - - - maven-clean-plugin - 3.1.0 - - - - maven-resources-plugin - 3.0.2 - - - maven-compiler-plugin - 3.8.0 - - - maven-surefire-plugin - 2.22.1 - - - maven-jar-plugin - 3.0.2 - - - maven-install-plugin - 2.5.2 - - - maven-deploy-plugin - 2.8.2 - - - - maven-site-plugin - 3.7.1 - - - maven-project-info-reports-plugin - 3.0.0 - - - - + + + + maven-assembly-plugin + + + + de.codeshield.log4jshell.Log4JDetector + + + + jar-with-dependencies + + + + + org.apache.maven.plugins + maven-compiler-plugin + + 8 + 8 + + + + + + + + maven-clean-plugin + 3.1.0 + + + + maven-resources-plugin + 3.0.2 + + + maven-compiler-plugin + 3.8.0 + + + maven-surefire-plugin + 2.22.1 + + + maven-jar-plugin + 3.0.2 + + + maven-install-plugin + 2.5.2 + + + maven-deploy-plugin + 2.8.2 + + + + maven-site-plugin + 3.7.1 + + + maven-project-info-reports-plugin + 3.0.0 + + + + diff --git a/src/main/java/de/codeshield/log4jshell/Log4JProcessDetector.java b/src/main/java/de/codeshield/log4jshell/Log4JProcessDetector.java new file mode 100644 index 0000000..ddce695 --- /dev/null +++ b/src/main/java/de/codeshield/log4jshell/Log4JProcessDetector.java @@ -0,0 +1,73 @@ +package de.codeshield.log4jshell; + +import org.apache.commons.lang.StringUtils; + +import java.io.BufferedReader; +import java.io.File; +import java.io.IOException; +import java.io.InputStreamReader; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; +import java.util.stream.Collectors; + +public class Log4JProcessDetector { + + public static void main(String[] args) throws IOException { + + // grep process (works on mac and linux) + List commands = new ArrayList(); + commands.add("/bin/sh"); + commands.add("-c"); + commands.add("ps -ef | grep java"); + + Process process = new ProcessBuilder(commands).start(); + BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream())); + StringBuilder builder = new StringBuilder(); + List lines = new ArrayList<>(); + String line = null; + while ((line = reader.readLine()) != null) { + lines.add(line); + } + String result = builder.toString(); + + // analyze each output + // search for the "-classpath" parameter + for (String outputLine : lines) { + String searchStr = "-classpath"; + int i = StringUtils.indexOf(outputLine, searchStr); + if (i == -1) { + // check if someone used -cp + searchStr = "-cp"; + i = StringUtils.indexOf(outputLine, searchStr); + } + + if (i > 0) { + String cpArgs = outputLine.substring(i + searchStr.length() + 1); + + // scan for jar files + String[] cpArgsSplit = cpArgs.split(File.pathSeparator); + final List foundJarsOnCp = + Arrays.stream(cpArgsSplit) + .map(x -> StringUtils.substring(x, 0, StringUtils.indexOf(x, ".jar") + 4)) + .collect(Collectors.toList()); + + for (String jarFile : foundJarsOnCp) { + try { + Log4JDetector detector = new Log4JDetector(); + System.out.println("Scanning jar file " + jarFile); + // detector.run(jarFile); + } catch (Exception e){ + System.out.println("Could not scan jar file " + jarFile); + } + } + + } else { + // no classpath arg found + continue; + } + } + + System.out.println(result); + } +}