Log4j2 Vulnerability Local Scanner (CVE-2021-45046)

Log4j vulnerability local detection script, scans all java processes on the host, detects whether a vulnerable log4j-core jar package has been introduced, and whether it may be subject to remote code execution attacks (CVE-2021-45046). Uploads the scan report to the specified server.

Scan all java processes on your host to check whether it's affected by log4j2 remote code execution(CVE-2021-45046), then upload the report to your api server.

Works under python2.7 / 2.6 / 3.x, no extra lib required.

Change Log

• 2021-12-22 Added log4j-core/pom.properties version detection

Scanning Logic

1. Iterate over java processes on the host
2. Iterate over jar packages opened by the java processes
3. Search for log4j-core-* jar packages
4. Recursively unzip other jar packages, search for log4j-core-* jar packages
5. In the log4j-core jar package, search for JndiLookup.class
6. After finding JndiLookup.class, based on its version number, jvm parameters, OS environment variables, whether it is a docker container process, k8s process, output whether the vulnerability exists, and output upgrade suggestions
7. Upload the scan results to the specified server

How It Works

• Find all java process on the host
• Find all jar files open by the java process
• Search for log4j-core-*.jar
• Recursively unzip other jar files，search for log4j-core-*.jar
• Search for JndiLookup.class in log4j-core-*.jar
• Once JndiLookup.class found，output some tips based on its version 、jvm args、OS env args、is docker container、is k8s
• Upload full report to your api server

Stability Mechanisms

• Recursion: recursively decompress jar packages, no more than 5 levels
• Memory: check its own memory usage on each decompression, no more than 300MB. If exceeded, skip the scan and report partial results and a memory error
• Network: after the scan is complete, randomly sleep 0~10 seconds. Assuming 10,000 hosts, only about 1,000 servers report per second

Batch Scanning

Can be integrated into an Agent, or the scan script can be delivered for one-time execution. You can also log in to the OPS machine and scan the entire network with one click.

You can use the script as a module by your agent, or deliver and run it only once.

Those who don't have an easy to use agent can run command below on your OPS server.

cat hosts.txt|xargs -P 5 -I{} sh -c 'ssh root@{} -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null "wget http://your_site/to_download/log4j2_vul_scanner.py -O /tmp/log4j2_vul_scanner.py -q && python /tmp/log4j2_vul_scanner.py && /usr/bin/rm /tmp/log4j2_vul_scanner.py" > ./logs.txt||exit 0'