m0rath/detect-log4j-exploitableBash script to detect Log4j (CVE-2021-44228) exploitable systems by scanning running Java processes for vulnerable log4j-core components without exploitation.
An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
This script will help to detect log4j exploit from the running process. It helps to find if any system is exploitable or not, without actully exploiting the code.
It will try to fetch process those using java and check for the log4j-core component.
Note: The script is written on bash, and using two packages(zip, unzip) which is required to run the script.
MITRE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
NIST: https://nvd.nist.gov/vuln/detail/CVE-2021-44228
Affected and unaffected products of Apache: https://blogs.apache.org/security/entry/cve-2021-44228
Release History of log4j: https://logging.apache.org/log4j/2.x/changes-report.html
Detailed video by Java Brains: https://www.youtube.com/watch?v=uyq8yxWO1ls
