Log4JShell-Bytecode-Detector - Local Bytecode Scanner for the Log4JShell Vulnerab

项目说明

<img src="logo.png" width="400">

🔍 Log4JShell Bytecode Detector

Log4jShell Bytecode Detector is an open source tool that helps identify if a jar file is affected by the critical C. The tool scans the jar file and compares the classses against a set of hashes for classes within the jar file. The hashes have been pre-computed for artifacts on Ma.

IMPORTANT UPDATE: We extended the list of affected artifacts on Ma. The list contains 18.816 artifacts. The artifacts either use log4j-core as declared dependency, or we identified .class files within the artifacts that match to the affected of log4j-core.

📝 How to run

1. Download the jar file under releases.
2. Run java -cp <PATH_TO_DOWNLOADED_JAR> de.codeshield.log4jshell.Log4JDetector <ABSOLUTE_PATH_TO_JAR_TO_CHECK>

If the jar is affected, the tool outputs information to the command-line:

📝 How to run on a li (no need to stop your running Ja)

1. Download the jar file under releases.
2. Run java -cp <PATH_TO_DOWNLOADED_JAR> de.codeshield.log4jshell.Log4JProcessDetector
3. The jar searches the classpath of all running ja for log4j instances

❓ Background on C

A serious Remote Code Execution has been discovered within log4j and 2.0-beta9 to 2.14 are affected. The has been classified as critical, as it affected log4j one of the most used logging libraries for Ja are many references and article out there.

* Hackernews
* BSI (german only)
* Proof of Concept for exploiting the
* Log4JShell Cheat Sheet

👀 Why is it important?

Log4j is and has been used in mostly any Ja for logging purposes. Now we need to understand which projects and libraries are actually affected. As of Java's dependency mechanism, an application can also be affected if it transitively includes the library . A project A includes a library lib transitively, if one of the direct dependecy B of A has a dependecy to lib. A simple test to see if one is affected can be done using using the ma tree:

Example: Execute command m:tree on a ma.

This check, however, is only a first indication and does not suffice due to the following reasons:

Ja are frequently:
* packaged as fatjar or uberjar: All class files (including direct and transiti) are shipped into a single jar file. (as we do for this software artifact)
* re-packaged or rebundled: the originaly package names are changed to avoid naming conflicts (some compilers and package mechanism apply code transformations)
* re-compiled: The source code is compiled with a different compiler and packaged as new, which leads to modified bytecode

Consequently, _*any*_ library a Ja is using can include the into your project. An in-depth bytecode analysis helps, which is what we publish as part of this repository.

📕 The script

1. Extract pom.xml files from .jar
2. check declared dependencies against a pre-computed list of affected groupId:artifactId: list for artifacts hosten on Ma
3. Extract .class files from .jar
4. Compute SHA hashes of the class file
5. Match SHAs against a pre-computed list

🛠 Build Instructions

To build this tool run

m

For assembling a runnable jar use

m compile assembly:single

💡 Precomputed Hashes of Classes

The set of hashes for classes has been pre-computed on entire Ma repository. The hashes of the classes contain all hashes that we identified as bytecode-similar using the Fingerprinting technology.

The pre-computed information contains:

* all artifacts that directly include log4j in any of the
* all artifacts that ship a class that contains a hash of log4j in the affected range
* all artifacts that rebundle a class of log4j
* all artifacts that have a re-compiled class of a class of log4j in the affected range

As affected range we considered 2.0-beta9, 2.15) [Reference.

💻 Fingerprinting Technology

This tool uses a new bytecode fingerprinting technology for Java that has been in by Andreas Dann. The basic flow is as follows.
1. Use the a fix commits Commit1, Commit2, and Commit3 to identify which classes are affected.
2. Compute bytecode "Fingerprints" of classes.
3. Search for other classes on Ma with same "Fingerprint".

*Note: For a simpler roll out, this repository does ship SHA hashes of the classes, the information has been computed using Fingerprinting*

📌 Disclaimer

The list of hashes and ma is not complete. We will regularly update the lists.

📯 Contributors

This tool was co-created by the CodeShield co-founders

* Andreas Dann <>
* Johannes Spaeth <>
* Manuel Benz <>

Feedback is welcome!

We are working on extending on the the list of affected artifacts and are always looking to improve our offering. contribution welcome

Also, ⭐️ this repository if our scanner helped you!

✍️ Contact

If you need support, or want to hear about our technology contact us at .

Your CodeShield Team 💚

项目信息

开发语言：Java

Star 数：49

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Local Bytecode Scanner for the Log4JShell Vulnerability (CVE-2021-44228)展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。