CVE-2021-44228_scanner - Scanners for Jar files that may be vulnerable to C

项目说明

C

Depending on the platform that you are in, the PowerShell or the Python3 script may make more sense to run. In both cases, the optional argument is the top-le that you would like to use to begin your search.

Any file discovered is worth in to determine if the application using it is . For any JndiLookup.class that is present, log4j commonly includes the in the jar file name. For example, a hit on log4j-core-2.14.1.jar would be indicative of a application. Alternatively, log4j-core-2.16.jar may also produce a hit because the JndiLookup code is still present in the 2.16 of log4j, but it is disabled by default. See for more details.

Screenshots

For example, here is an in of the PowerShell of the scanner:
!checkjndi.ps1 execution on c:\\

Similarly, here is an in of the Python3 :
!checkjndi.py execution on c:\\

Finally, here is an in of the Bash :
!checkjndi.sh execution on ~/in

Interpreting results

Note that the Bash and Python of this script will by design limit scans to a single filesystem.
With the PowerShell , locations to scan can be piped into the script to ha of what is checked. For example, to scan a list of paths conatined in a the file paths.txt:

Let's look at the first hit on our Windows scan execution:

Based on the jar name, this is a library from log4j 2.15. While this of log4j fixes C, it still contained a flaw that is outlined as C. The impact of C is a denial of service for only certain Ja that use log4j 2.15. For Ja that use log4j prior to 2.15 and that also fit the prerequisites for C applying, the impact is RCE.

Let's look at the second hit:

This jar file contains a 2.16 of log4j, which is not to C. This result is reported for information purposes, which shows that a has patched their product.

Let's look at the third hit:

Here we can see that Ghidra uses log4j 2.12.1, and as such we should assume it to be . And indeed, Ghidra before 10.1 are to C.

You should in any hits reported by either of these scripts, and confirm that either the log4j is indeed the fixed 2.16 , or reach out to your software to obtain a fixed of the software. Alternatively, has information about how JndiLookup.class can be removed from jar files.

Errors returned

The PowerShell of the scanner has additional error reporting when files or directories cannot be in. In particular, any Unable to scan errors reporting UnauthorizedAccessException is indicative of a permission problem in accessing a directory and/or a file. Any Unable to scan errors reporting In is usually due to a corrupt archive.

项目信息

开发语言：PowerShell

Star 数：350

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Scanners for Jar files that may be vulnerable to CVE-2021-44228展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。