CVE-2021-44228-Scanner - Vulnerability scanner and mitigation patch for Log

项目说明

!Logpresso Logo

log4j2-scan is a single binary command-line tool for C scanning and mitigation patch. It also supports nested JAR file scanning and patch. It also detects C (log4j 2.15.0), C (log4j 2.16.0), C (log4j 2.17.0), C, C, C, C, C, C, C (log4j 1.x), and C (logback 0.9-1.2.7) .

Log4j Risk Management

You can integrate log4j2-scan with Logpresso Watch service for reporting and patch management. Visit for details.

Download

* log4j2-scan 3.0.1 (Windows x64, 7z)
* log4j2-scan 3.0.1 (Windows x64, zip)
* If you get .dll not found error, install C++ Redistributable.
* If nati doesn't work, use the JAR instead. 32bit is not supported.
* 7zip is a from www.7zip.org, and is open source and free.
* log4j2-scan 3.0.1 (Linux x64)
* log4j2-scan 3.0.1 (Linux aarch64)
* If nati doesn't work, use the JAR instead. 32bit is not supported.
* log4j2-scan 3.0.1 (Mac OS)
* log4j2-scan 3.0.1 (Any OS, 620KB)

Build

* How to build Nati

How to use

Just run log4j2-scan.exe or log4j2-scan with target directory path. The logpresso-log4j2-scan.jar should work with JRE/JDK 7+

--fix option is supported for following :
* Log4j v2
* C (JndiLookup)
* C (JndiLookup)
* Log4j v1
* C (JMSAppender)
* C (SocketServer)
* C (SMTPAppender)
* C (JMSSink)
* C (JDBCAppender)
* C (chainsaw package)

--fix option doesn't mitigate following :
* Log4j v2
* C (JDBCAppender)
* C (DoS)
* C (SocketServer)
* C (SMTPAppender)
* Logback
* C

Usage

On Windows

On Linux

On UNIX (AIX, Solaris, and so on)

If you add --fix option, this program will copy original JAR file to .bak file, and create new JAR file without org/apache/logging/log4j/core/lookup/JndiLookup.class entry. All .bak files are archived into the single zip file which is named by log4j2_scan_backup_yyyyMMdd_HHmmss.zip, then deleted safely. In most en, JNDI lookup feature will not be used. However, you must use this option at your own risk. You can easily restore original JAR files using --restore option.

Depending the Operating System:

Windows: It is necessary to shutdown any running J before applying patch due to lock files. Start affected J after fix.

Linux/macOS: Apply patch, restart the J

If you want to automate patch job, use --force-fix option. With this option, this program will no longer prompt for confirmation.

(mitigated) tag will be displayed if org/apache/logging/log4j/core/lookup/JndiLookup.class entry is removed from JAR file.

If you add --trace option, this program will print all directories and files. Use this option only for debugging.

On Windows:

How it works

Run in 5 steps:
1. Find all .jar, .war, .ear, .aar, .rar, .nar files recursively.
2. Find META-INF/maven/org.apache.logging.log4j/log4j-core/pom.properties entry from JAR file.
3. Read groupId, artifactId, and .
4. Compare log4j2 and print .
5. If --fix option is used, backup file and patch it.
* For example, original .jar is copied to .jar.bak
6. Archive all backup files into the zip file log4j2_scan_backup_yyyyMMdd_HHmmss.zip, then delete .bak files.

Exit code for automation

* -1 failed to run
* 0 for clean (No )
* 1 for found
* 2 for some errors

Tool Integrations

* HCL BigFix
* Checkmk
* See also checkmk C agent plugin

Contact

If you have any question or issue, create an issue in this repository.

About Logpresso

Logpresso is a leading company in the AI and big data industry located in South Korea.
Logpresso provides SIEM, SOAR, Log management, and FDS solutions with its own big data platform.

项目信息

开发语言：Java

Star 数：861

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。