Initial commit

stripe · Dec 15, 2021 · 167e1f9 · 167e1f9
commit 167e1f9
Show file tree

Hide file tree

Showing 21 changed files with 1,564 additions and 0 deletions.
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,2 @@
+.DS_Store
+*.log
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at conduct@stripe.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021- Stripe, Inc. (https://stripe.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
@@ -0,0 +1,42 @@
+# `log4j-remediation-tools`
+
+> Tools for finding and reproducing the [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) `log4j2` vulnerability
+
+## Tools
+
+- [`find-vulnerabilities`](./find-vulnerabilities): determine heuristically whether a running JVM is vulnerable
+- [`confirm-vulnerabilities`](./confirm-vulnerabilities): determine with 100% accuracy whether a running JVM is vulnerable
+
+## Usage
+
+Both of these tools scan all running JVM processes on a machine, and produce a CSV report about which processes may be / are vulnerable.
+
+Check out the corresponding READMEs for [`find-vulnerabilities/`](./find-vulnerabilities) and [`confirm-vulnerabilities/`](./confirm-vulnerabilities) for usage details.
+
+### Which tool should I use?
+
+Here are a few tradeoffs to help you determine which tool is right for your use case:
+
+`find-vulnerabilities` is low-risk to run, but has the possibility of missing:
+
+- Cases where a system property is not set on the CLI, e.g. at runtime
+- Cases where the JVM has closed the file descriptor for the jar
+- Non-standard / patched releases of `log4j2`
+
+`confirm-vulnerabilities` uses the JVM Attach API which:
+
+- May not work if an application explicitly disables this API
+- May crash the running JVM due to JVM bugs
+- May briefly slow down the running JVM while waiting for JVM pause
+
+## Contributing
+
+This project welcomes feedback and contributions; however, we might be slow to respond to or triage your requests. We appreciate your patience.
+
+## License
+
+This project uses the [MIT license](LICENSE.md).
+
+## Code of conduct
+
+This project has adopted the Stripe [Code of conduct](CODE_OF_CONDUCT.md).
diff --git a/confirm-vulnerabilities/README.md b/confirm-vulnerabilities/README.md
@@ -0,0 +1,73 @@
+# Confirm vulnerabilities
+
+> Determine with 100% accuracy whether a running JVM is vulnerable
+
+Authoritatively scans all running JVM's for the December 2021 Log4j exploit [CVE-2021-44228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).
+It does this by injecting actual `Logger.error("${jndi:ldap://...})` calls into the running application and checking for
+LDAP network requests made by Log4j.
+
+Specifically, this confirms vulnerability to data exfiltration _and_ remote code execution (it does not differentiate between those two).
+
+## Usage
+
+(For now you need to compile using Java 11, but you can run it on any version 8 or 11+.)
+```sh
+mvn package
+```
+
+Java 8:
+```sh
+java -cp <java-home>/lib/tools.jar:target/is-it-vulnerable-1.0-SNAPSHOT.jar com.stripe.log4j.isitvuln.IsItVuln
+```
+
+Java 11:
+```sh
+java -jar target/is-it-vulnerable-1.0-SNAPSHOT.jar
+```
+
+This will attempt to inject code into all JVM's running on the machine, and report status in CSV format.
+
+### Example output
+
+Sample output to `stdout`:
+
+```csv
+date,host,tool,version,pid,path,jre,log4j,log4j version,formatMsgNoLookups,ldap trustURLCodebase,rmi trustURLCodebase,cosnaming trustURLCodebase,exploited
+2021-12-14T22:58:04.435774Z,st-keithl1,is-it-vuln,1,18742,/Library/Java/JavaVirtualMachines/amazon-corretto-11.jdk/Contents/Home,Amazon.com Inc. - OpenJDK 64-Bit Server VM - 11.0.13,true,false,unknown,unknown,true,none,vulnerable
+2021-12-14T22:58:04.435748Z,st-keithl1,is-it-vuln,1,18741,/Library/Java/JavaVirtualMachines/amazon-corretto-11.jdk/Contents/Home,Amazon.com Inc. - OpenJDK 64-Bit Server VM - 11.0.13,true,unknown,unknown,unknown,unknown,none,not vulnerable
+```
+
+| date                        | host       | tool       | version | pid   | path                                                                   | jre                                                  | log4j | log4j version | formatMsgNoLookups | ldap trustURLCodebase | rmi trustURLCodebase | cosnaming trustURLCodebase | exploited      |
+| --------------------------- | ---------- | ---------- | ------- | ----- | ---------------------------------------------------------------------- | ---------------------------------------------------- | ----- | ------------- | ------------------ | --------------------- | -------------------- | -------------------------- | -------------- |
+| 2021-12-14T22:58:04.435774Z | st-keithl1 | is-it-vuln | 1       | 18742 | /Library/Java/JavaVirtualMachines/amazon-corretto-11.jdk/Contents/Home | Amazon.com Inc. - OpenJDK 64-Bit Server VM - 11.0.13 | true  | false         | unknown            | unknown               | true                 | none                       | vulnerable     |
+| 2021-12-14T22:58:04.435748Z | st-keithl1 | is-it-vuln | 1       | 18741 | /Library/Java/JavaVirtualMachines/amazon-corretto-11.jdk/Contents/Home | Amazon.com Inc. - OpenJDK 64-Bit Server VM - 11.0.13 | true  | unknown       | unknown            | unknown               | unknown              | none                       | not vulnerable |
+
+The last column is the most important: it is `vulnerable` or `not vulnerable`. If
+`vulnerable` this indicates that Log4J did make an HTTP request when logging a `${jndi:...}` string.
+
+It also prints status updates to stderr:
+
+```sh
+Will use this jar for agent: /Users/.../target/is-it-vulnerable-1.0-SNAPSHOT.jar
+Attempting to attach to to 23378 running org.jetbrains.idea.maven.server.RemoteMavenServer36
+Attempting to attach to to 24730 running org.jetbrains.idea.maven.server.RemoteMavenServer36
+Attempting to attach to to 36200 running LDAPRefServer
+Attempting to attach to to 18741 running org.jetbrains.jps.cmdline.Launcher
+Attempting to attach to to 8383 running
+Attempting to attach to to 18742 running com.stripe.Repro
+Failed to attach to 24730 running org.jetbrains.idea.maven.server.RemoteMavenServer36: com.sun.tools.attach.AgentInitializationException: Agent JAR loaded but agent failed to initialize
+Failed to attach to 23378 running org.jetbrains.idea.maven.server.RemoteMavenServer36: com.sun.tools.attach.AgentInitializationException: Agent JAR loaded but agent failed to initialize
+Failed to attach to 8383 running : com.sun.tools.attach.AgentInitializationException: Agent JAR loaded but agent failed to initialize
+Failed to attach to 36200 running LDAPRefServer: com.sun.tools.attach.AgentInitializationException: Agent JAR loaded but agent failed to initialize
+Parsing /var/folders/zd/71fgr5392y79q54tzgc2zn700000gn/T/is-it-vuln501360083800619055/result-18742.csv
+unknown,st-keithl1,full,1,18742,/Library/Java/JavaVirtualMachines/amazon-corretto-11.jdk/Contents/Home,Amazon.com Inc. - OpenJDK 64-Bit Server VM - 11.0.13,true,none,false,unknown,unknown,true,none,vulnerable,maybe
+Parsing /var/folders/zd/71fgr5392y79q54tzgc2zn700000gn/T/is-it-vuln501360083800619055/result-18741.csv
+
+```
+
+In your running application you should see this output (though if you don't, it doesn't invalidate the CSV printed by the tool itself):
+
+```sh
+Attempting to log IsItVuln ExploitAttempt ${jndi:ldap://127.0.0.1:61092/x}
+17:39:40.239 [Attach Listener] ERROR com.stripe.log4j.isitvuln.IsItVulnAgent - IsItVuln ExploitAttempt ${jndi:ldap://127.0.0.1:61092/x}
+```
diff --git a/confirm-vulnerabilities/is-it-vulnerable.iml b/confirm-vulnerabilities/is-it-vulnerable.iml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module org.jetbrains.idea.maven.project.MavenProjectsManager.isMavenModule="true" type="JAVA_MODULE" version="4">
+  <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8">
+    <output url="file://$MODULE_DIR$/target/classes" />
+    <output-test url="file://$MODULE_DIR$/target/test-classes" />
+    <content url="file://$MODULE_DIR$">
+      <sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
+      <sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" />
+      <sourceFolder url="file://$MODULE_DIR$/src/test/java" isTestSource="true" />
+      <excludeFolder url="file://$MODULE_DIR$/target" />
+    </content>
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+    <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-core:2.14.1" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-api:2.14.1" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven.plugins:maven-compiler-plugin:3.8.1" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven:maven-plugin-api:3.0" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven:maven-model:3.0" level="project" />
+    <orderEntry type="library" name="Maven: org.sonatype.sisu:sisu-inject-plexus:1.4.2" level="project" />
+    <orderEntry type="library" name="Maven: org.sonatype.sisu:sisu-inject-bean:1.4.2" level="project" />
+    <orderEntry type="library" name="Maven: org.sonatype.sisu:sisu-guice:noaop:2.1.7" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven:maven-artifact:3.0" level="project" />
+    <orderEntry type="library" name="Maven: org.codehaus.plexus:plexus-utils:2.0.4" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven:maven-core:3.0" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven:maven-settings:3.0" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven:maven-settings-builder:3.0" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven:maven-repository-metadata:3.0" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven:maven-model-builder:3.0" level="project" />
+    <orderEntry type="library" scope="RUNTIME" name="Maven: org.apache.maven:maven-aether-provider:3.0" level="project" />
+    <orderEntry type="library" name="Maven: org.sonatype.aether:aether-impl:1.7" level="project" />
+    <orderEntry type="library" name="Maven: org.sonatype.aether:aether-spi:1.7" level="project" />
+    <orderEntry type="library" name="Maven: org.sonatype.aether:aether-api:1.7" level="project" />
+    <orderEntry type="library" name="Maven: org.sonatype.aether:aether-util:1.7" level="project" />
+    <orderEntry type="library" name="Maven: org.codehaus.plexus:plexus-interpolation:1.14" level="project" />
+    <orderEntry type="library" name="Maven: org.codehaus.plexus:plexus-classworlds:2.2.3" level="project" />
+    <orderEntry type="library" name="Maven: org.codehaus.plexus:plexus-component-annotations:1.5.5" level="project" />
+    <orderEntry type="library" name="Maven: org.sonatype.plexus:plexus-sec-dispatcher:1.3" level="project" />
+    <orderEntry type="library" name="Maven: org.sonatype.plexus:plexus-cipher:1.4" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven.shared:maven-shared-utils:3.2.1" level="project" />
+    <orderEntry type="library" name="Maven: commons-io:commons-io:2.5" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.maven.shared:maven-shared-incremental:1.1" level="project" />
+    <orderEntry type="library" name="Maven: org.codehaus.plexus:plexus-java:0.9.10" level="project" />
+    <orderEntry type="library" name="Maven: org.ow2.asm:asm:6.2" level="project" />
+    <orderEntry type="library" name="Maven: com.thoughtworks.qdox:qdox:2.0-M8" level="project" />
+    <orderEntry type="library" name="Maven: org.codehaus.plexus:plexus-compiler-api:2.8.4" level="project" />
+    <orderEntry type="library" name="Maven: org.codehaus.plexus:plexus-compiler-manager:2.8.4" level="project" />
+    <orderEntry type="library" scope="RUNTIME" name="Maven: org.codehaus.plexus:plexus-compiler-javac:2.8.4" level="project" />
+  </component>
+</module>
diff --git a/confirm-vulnerabilities/pom.xml b/confirm-vulnerabilities/pom.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.stripe.log4j</groupId>
+    <artifactId>is-it-vulnerable</artifactId>
+    <version>1.0-SNAPSHOT</version>
+
+    <properties>
+        <maven.compiler.target>1.8</maven.compiler.target>
+        <maven.compiler.source>1.8</maven.compiler.source>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
+            <version>2.14.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-compiler-plugin</artifactId>
+            <version>3.8.1</version>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-shade-plugin</artifactId>
+                <version>3.2.4</version>
+                <executions>
+                    <execution>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>shade</goal>
+                        </goals>
+                        <configuration>
+                            <transformers>
+                                <transformer
+                                        implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
+                                    <manifestEntries>
+                                        <Main-Class>com.stripe.log4j.isitvuln.IsItVuln</Main-Class>
+                                        <Build-Number>123</Build-Number>
+                                        <Agent-Class>com.stripe.log4j.isitvuln.IsItVulnAgent</Agent-Class>
+                                    </manifestEntries>
+                                </transformer>
+                            </transformers>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>
diff --git a/confirm-vulnerabilities/src/main/java/com/stripe/log4j/isitvuln/FileFormats.java b/confirm-vulnerabilities/src/main/java/com/stripe/log4j/isitvuln/FileFormats.java
@@ -0,0 +1,37 @@
+package com.stripe.log4j.isitvuln;
+
+import java.util.Arrays;
+import java.util.List;
+
+public class FileFormats {
+  public static final List<String> SYSPROPS_FOR_CSV = Arrays.asList(
+      "log4j2.formatMsgNoLookups",
+      "com.sun.jndi.rmi.object.trustURLCodebase",
+      "com.sun.jndi.cosnaming.object.trustURLCodebase",
+      "com.sun.jndi.ldap.object.trustURLCodebase");
+
+  public static String toCsv(String... cells) {
+    StringBuilder sb = new StringBuilder();
+    boolean first = true;
+    for (String cell : cells) {
+      if (!first) {
+        sb.append(',');
+      }
+      first = false;
+      sb.append(escapeSpecialCharacters(cell));
+    }
+    return sb.toString();
+  }
+
+  public static String escapeSpecialCharacters(String data) {
+    if (data == null) {
+      return "null";
+    }
+    String escapedData = data.replaceAll("\\R", " ");
+    if (data.contains(",") || data.contains("\"") || data.contains("'")) {
+      data = data.replace("\"", "\"\"");
+      escapedData = "\"" + data + "\"";
+    }
+    return escapedData;
+  }
+}
diff --git a/confirm-vulnerabilities/src/main/java/com/stripe/log4j/isitvuln/HostInfo.java b/confirm-vulnerabilities/src/main/java/com/stripe/log4j/isitvuln/HostInfo.java
@@ -0,0 +1,28 @@
+package com.stripe.log4j.isitvuln;
+
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+
+public class HostInfo {
+  public static final String HOSTNAME = getHostname();
+
+  private static String getHostname() {
+    InetAddress localHost;
+    try {
+      localHost = InetAddress.getLocalHost();
+    } catch (Exception e) {
+      System.err.println("Could not get local host address");
+      e.printStackTrace();
+      return "unknown";
+    }
+    try {
+      return localHost.getHostName();
+    } catch (Exception e) {
+      System.err.println("Could not get local host name");
+      e.printStackTrace();
+      return localHost.toString();
+    }
+  }
+}