Log4Shell CVE-2021-44228 Mitigation Ansible Role

This Ansible role deploys a Python-based script to programmatically mitigate the Log4Shell vulnerability (CVE-2021-44228) by removing the vulnerable JndiLookup class from affected Log4j JAR files.

It is designed to be run via Ansible, but you can also execute the script manually if you wish.

Read more about the Log4Shell vulnerability here:

• Wikipedia
• NVD CVE-2021-44228
• Our Twitter Thread

Features

• Searches for Log4j JARs in specified application directories
• Verifies if JndiLookup.class is present
• Backs up the original JAR before modification
• Removes JndiLookup.class from the JAR
• Writes all actions to a log file
• Configurable via a YAML file
• Packaged as an Ansible role for automated deployment across multiple systems

Requirements

• Python 3.6+
• zip and zipinfo installed on the target systems
• PyYAML installed on the target systems (pip install pyyaml)

Configuration

The script is configured via a YAML file, templated automatically by the role.

Example config.yaml:

app_directories:
  - /opt/apps
backup_directory: /opt/backups
log_file: /var/log/log4j_mitigation.log

• app_directories: list of directories to scan for JAR files
• backup_directory: where to store the original JAR backups
• log_file: path to a log file for operation tracking

Usage as an Ansible Role

Add this role to your playbook:

- name: Mitigate Log4Shell CVE-2021-44228
  hosts: all
  become: true
  roles:
    - log4shell_mitigation

Usage Directly

If you wish to run the script manually, you can do so:

1. Copy the script to your target machine:

   root@kitploit:~

   files/log4shell_mitigator.py
   

2. Create your own config.yaml in the same directory.

3. Run it:

   root@kitploit:~

   python3 log4shell_mitigator.py
   

Validation

• Check the configured log file (default: /var/log/log4j_mitigation.log) to see which JARs were patched
• Confirm your applications still start correctly after the class removal
• Ideally, test in a staging environment before production rollout

Notes

• This approach does not upgrade Log4j but removes the vulnerable class to block the exploit path
• You should still upgrade Log4j as a long-term fix
• Always test thoroughly before rolling out widely

License

MIT

Contributing

PRs and improvements welcome -> please fork and submit a merge request.

Disclaimer

This software and accompanying Ansible role are provided “as is” and without warranties of any kind, express or implied. You are solely responsible for evaluating and testing the suitability, safety, and effectiveness of this code before applying it to any environment. AxisOps Ltd (GB08681761) expressly disclaims any liability for damages, data loss, service interruption, or other harm resulting from the use or misuse of this code.

Use at your own risk. Always audit, test, and validate the code in a controlled environment before deployment to production.

SysOps Team @ AxisOps