Detect patched log4j-core-2*.jar ?

[tjyang]

Hi

Can this program adding ability to check the .class are taken out of older log4j-core-.jar ?

Patched *.jar = jndiLookup.class removal and set log4j2.formatMsgNoLookups=true

[hupe1980]

The scanner inspects JAR Files whether they contains the file JndiLookup.class. If so, the bytecode of JndiManager.class is checked to see whether it is a log4j version >= 2.15.0

After removing the JndiLookup.class file, the scanner no longer issues an alarm

[tjyang]

• This is my sample jar files.

[pi@centos7t01 github]$ ls  -lrth /tmp/*.jar
-rw-r--r-- 1 pi pi 1.8M Dec 16 19:22 /tmp/log4j-core-2.16.0.jar
-rw-r--r-- 1 pi pi 1.5M Dec 16 19:22 /tmp/log4j-core-2.9.1.jar   #<-- this one is patched via removal of jndiLookup.class
-rw-r--r-- 1 pi pi 1.5M Dec 16 19:22 /tmp/log4j-core-2.9.1.unpatched.jar
[pi@centos7t01 github]$

• the scan

[pi@centos7t01 github]$ scan4log4shell local /tmp
[i] Log4Shell CVE-2021-44228 Local Vulnerability Scan
[!] Hit: possibly vulnerable file identified: /tmp/log4j-core-2.9.1.unpatched.jar
[x] Error: /tmp/systemd-private-7546a27e96df49dcb087991ab7126f6b-colord.service-iJUNZ1: open /tmp/systemd-private-7546a27e96df49dcb087991ab7126f6b-colord\
.service-iJUNZ1: permission denied
[x] Error: /tmp/systemd-private-7546a27e96df49dcb087991ab7126f6`
<snipped>

• what I am hoping to to see is listing of good,patched, vulnerable log4j-core*.jar files listing the scan output.
  • existing output doesn't display patched and good ones.

[hupe1980]

An info about patched versions is now available

[tjyang]

Thanks for the addition.

• tested with version 0.13.0

[pi@centos7t01 scan4log4]$ ./scan4log4shell --version
scan4log4shell version 0.13.0
[pi@centos7t01 scan4log4]$ sudo ./scan4log4shell local  /tmp/
[i] Log4Shell Local Vulnerability Scan
[!] Hit: possibly CVE-2021-45046 vulnerable file identified: /tmp/apache-log4j-2.9.1-bin/log4j-core-2.9.1.jar
[!] Hit: possibly CVE-2021-45105 vulnerable file identified: /tmp/apache-log4j-2.9.1-bin/log4j-core-2.9.1.jar
[!] Hit: possibly CVE-2021-44228 vulnerable file identified: /tmp/apache-log4j-2.9.1-bin/log4j-core-2.9.1.jar
[!] Hit: possibly CVE-2021-45046 vulnerable file identified: /tmp/apache-log4j-2.9.1-bin.patched/apache-log4j-2.9.1-bin/log4j-core-2.9.1.jar
[!] Hit: possibly CVE-2021-45105 vulnerable file identified: /tmp/apache-log4j-2.9.1-bin.patched/apache-log4j-2.9.1-bin/log4j-core-2.9.1.jar
[i] Safe: possibly CVE-2021-44228 patched (no JndiLookup.class) file identified: /tmp/apache-log4j-2.9.1-bin.patched/apache-log4j-2.9.1-bin/log4j-core-2.9.1.jar
[i] Completed scanning
[pi@centos7t01 scan4log4]$