Logpresso Logo

log4j2-scan은 CVE-2021-44228 취약점 스캔 및 완화 패치를 위한 단일 바이너리 명령줄 도구입니다. 또한 중첩된 JAR 파일 스캔 및 패치를 지원하며, CVE-2021-45046 (log4j 2.15.0), CVE-2021-45105 (log4j 2.16.0), CVE-2021-44832 (log4j 2.17.0), CVE-2021-4104, CVE-2019-17571, CVE-2017-5645, CVE-2020-9488, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307 (log4j 1.x) 및 CVE-2021-42550 (logback 0.9-1.2.7) 취약점도 탐지합니다.

Log4j 위험 관리

log4j2-scan을 Logpresso Watch 서비스와 통합하여 보고 및 패치 관리를 할 수 있습니다. 자세한 내용은 https://logpresso.watch를 방문하세요.

다운로드

log4j2-scan 3.0.1 (Windows x64, 7z)
log4j2-scan 3.0.1 (Windows x64, zip)
- VCRUNTIME140.dll not found 오류가 발생하면 Visual C++ Redistributable을 설치하십시오.
- 네이티브 실행 파일이 동작하지 않으면 JAR을 대신 사용하십시오. 32비트는 지원되지 않습니다.
- 7zip은 www.7zip.org에서 구할 수 있으며 오픈 소스이고 무료입니다.
log4j2-scan 3.0.1 (Linux x64)
log4j2-scan 3.0.1 (Linux aarch64)
- 네이티브 실행 파일이 동작하지 않으면 JAR을 대신 사용하십시오. 32비트는 지원되지 않습니다.
log4j2-scan 3.0.1 (Mac OS)
log4j2-scan 3.0.1 (Any OS, 620KB)

빌드

네이티브 이미지 빌드 방법

사용 방법

대상 디렉터리 경로를 지정하여 log4j2-scan.exe 또는 log4j2-scan을 실행하기만 하면 됩니다. logpresso-log4j2-scan.jar는 JRE/JDK 7 이상에서 동작합니다.

--fix 옵션은 다음 취약점에 대해 지원됩니다:

Log4j v2
- CVE-2021-44228 (JndiLookup)
- CVE-2021-45046 (JndiLookup)
Log4j v1
- CVE-2021-4104 (JMSAppender)
- CVE-2019-17571 (SocketServer)
- CVE-2020-9488 (SMTPAppender)
- CVE-2022-23302 (JMSSink)
- CVE-2022-23305 (JDBCAppender)
- CVE-2022-23307 (chainsaw package)

--fix 옵션은 다음 취약점을 완화하지 않습니다:

Log4j v2
- CVE-2021-44832 (JDBCAppender)
- CVE-2021-45105 (DoS)
- CVE-2017-5645 (SocketServer)
- CVE-2020-9488 (SMTPAppender)
Logback
- CVE-2021-42550

사용법

Logpresso CVE-2021-44228 Vulnerability Scanner 3.0.1 (2022-02-13)
Usage: log4j2-scan [--scan-log4j1] [--fix] target_path1 target_path2

-f [config_file_path]
        Specify config file path which contains scan target paths.
        Paths should be separated by new line. Prepend # for comment.
--scan-log4j1
        Enables scanning for log4j 1 versions.
--scan-logback
        Enables scanning for logback CVE-2021-42550.
--scan-zip
        Scan also .zip extension files. This option may slow down scanning.
--zip-charset
        Specify an alternate zip encoding other than utf-8. System default charset is used if not specified.
--fix
        Backup original file and remove JndiLookup.class from JAR recursively.
        With --scan-log4j1 option, it also removes JMSAppender.class, SocketServer.class, SMTPAppender.class, SMTPAppender$1.class,
        JMSSink.class, JDBCAppender.class, and all classes of org.apache.log4j.chainsaw package
--force-fix
        Do not prompt confirmation. Don't use this option unless you know what you are doing.
--restore [backup_file_path]
        Unfix JAR files using zip archived file.
--backup-path [zip_output_path]
        Specify backup file path.
--backup-ext [zip]
        Specify backup file extension. zip by default.
        If --backup-path is specified, this option is ignored.
--all-drives
        Scan all drives on Windows
--drives c,d
        Scan specified drives on Windows. Spaces are not allowed here.
--no-symlink
        Do not detect symlink as vulnerable file.
--exclude [path_prefix]
        Path prefixes of directories whose absolute path starts with the specified value will be excluded.
        Does not support relative paths. You can specify multiple --exclude [path_prefix] pairs
--exclude-config [config_file_path]
        Specify exclude path prefix list in text file. Paths should be separated by new line. Prepend # for comment.
--exclude-pattern [pattern]
        Exclude specified paths of directories by pattern. Supports fragments.
        You can specify multiple --exclude-pattern [pattern] pairs (non regex)
--exclude-file-config [config_file_path]
        Specify exclude file path list in text file. Paths should be separated by new line. Prepend # for comment.
--exclude-fs nfs,tmpfs
        Exclude paths by file system type. nfs, nfs3, nfs4, afs, cifs, autofs,
        tmpfs, devtmpfs, fuse.sshfs, smbfs and iso9660 is ignored by default.
--api-key [key]
        Send reports to Logpresso Watch service.
--http-proxy [addr:port]
        Send reports via specified HTTP proxy server.
--syslog-udp [host:port]
        Send reports to remote syslog host.
        Send vulnerable, potentially vulnerable, and mitigated reports by default.
--syslog-level [level]
        Send reports only if report is higher or equal to specified level.
        Specify alert for vulnerable and potentially vulnerable reports.
        Specify info for vulnerable, potentially vulnerable, and mitigated reports.
        Specify debug for vulnerable, potentially vulnerable, mitigated, and error reports.
--syslog-facility [code]
        Default value is 16 (LOCAL0). Facility value must be in the range of 0 to 23 inclusive.
--rfc5424
        Follow RFC5424 The Syslog Protocol strictly.
--report-csv
        Generate log4j2_scan_report_yyyyMMdd_HHmmss.csv in working directory if not specified otherwise via --report-path [path]
--report-json
        Generate log4j2_scan_report_yyyyMMdd_HHmmss.json in working directory if not specified otherwise via --report-path [path]
--report-patch
        Report also patched log4j file.
--report-path
        Specify report output path including filename. Implies --report-csv.
--report-dir
        Specify report output directory. Implies --report-csv.
--no-empty-report
        Do not generate empty report.
--csv-log-path
        Specify csv log file path. If log file exists, log will be appended.
--json-log-path
        Specify json log file path. If log file exists, log will be appended.
--old-exit-code
        Return sum of vulnerable and potentially vulnerable files as exit code.
--debug
        Print exception stacktrace for debugging.
--trace
        Print all directories and files while scanning.
--silent
        Do not print progress message.
--throttle
        Limit scan files per second.
--help
        Print this help.

Windows에서

log4j2-scan [--fix] target_path

Linux에서

./log4j2-scan [--fix] target_path

UNIX에서 (AIX, Solaris 등)

java -jar logpresso-log4j2-scan-3.0.1.jar [--fix] target_path

--fix 옵션을 추가하면 이 프로그램은 취약한 원본 JAR 파일을 .bak 파일로 복사하고, org/apache/logging/log4j/core/lookup/JndiLookup.class 항목이 없는 새 JAR 파일을 생성합니다. 모든 .bak 파일은 log4j2_scan_backup_yyyyMMdd_HHmmss.zip이라는 단일 zip 파일로 보관된 후 안전하게 삭제됩니다. 대부분의 환경에서 JNDI lookup 기능은 사용되지 않습니다. 그러나 이 옵션은 사용자 책임 하에 사용해야 합니다. --restore 옵션을 사용하여 원본 취약 JAR 파일을 쉽게 복원할 수 있습니다.

운영 체제에 따라:

Windows: 잠금 파일 때문에 패치를 적용하기 전에 실행 중인 모든 JVM 프로세스를 종료해야 합니다. 패치 적용 후 영향을 받은 JVM 프로세스를 시작하십시오.
Linux/macOS: 패치를 적용한 후 JVM을 다시 시작하십시오.

패치 작업을 자동화하려면 --force-fix 옵션을 사용하십시오. 이 옵션을 사용하면 이 프로그램은 더 이상 확인을 요청하지 않습니다.

JAR 파일에서 org/apache/logging/log4j/core/lookup/JndiLookup.class 항목이 제거되면 (mitigated) 태그가 표시됩니다.

--trace 옵션을 추가하면 이 프로그램은 방문한 모든 디렉터리와 파일을 출력합니다. 이 옵션은 디버깅 전용으로만 사용하십시오.

Logpresso CVE-2021-44228 Vulnerability Scanner 3.0.1 (2022-02-13) Usage: log4j2-scan [--scan-log4j1] [--fix] target_path1 target_path2 -f [config_file_path] Specify config file path which contains scan target paths. Paths should be separated by new line. Prepend # for comment. --scan-log4j1 Enables scanning for log4j 1 versions. --scan-logback Enables scanning for logback CVE-2021-42550. --scan-zip Scan also .zip extension files. This option may slow down scanning. --zip-charset Specify an alternate zip encoding other than utf-8. System default charset is used if not specified. --fix Backup original file and remove JndiLookup.class from JAR recursively. With --scan-log4j1 option, it also removes JMSAppender.class, SocketServer.class, SMTPAppender.class, SMTPAppender$1.class, JMSSink.class, JDBCAppender.class, and all classes of org.apache.log4j.chainsaw package --force-fix Do not prompt confirmation. Don't use this option unless you know what you are doing. --restore [backup_file_path] Unfix JAR files using zip archived file. --backup-path [zip_output_path] Specify backup file path. --backup-ext [zip] Specify backup file extension. zip by default. If --backup-path is specified, this option is ignored. --all-drives Scan all drives on Windows --drives c,d Scan specified drives on Windows. Spaces are not allowed here. --no-symlink Do not detect symlink as vulnerable file. --exclude [path_prefix] Path prefixes of directories whose absolute path starts with the specified value will be excluded. Does not support relative paths. You can specify multiple --exclude [path_prefix] pairs --exclude-config [config_file_path] Specify exclude path prefix list in text file. Paths should be separated by new line. Prepend # for comment. --exclude-pattern [pattern] Exclude specified paths of directories by pattern. Supports fragments. You can specify multiple --exclude-pattern [pattern] pairs (non regex) --exclude-file-config [config_file_path] Specify exclude file path list in text file. Paths should be separated by new line. Prepend # for comment. --exclude-fs nfs,tmpfs Exclude paths by file system type. nfs, nfs3, nfs4, afs, cifs, autofs, tmpfs, devtmpfs, fuse.sshfs, smbfs and iso9660 is ignored by default. --api-key [key] Send reports to Logpresso Watch service. --http-proxy [addr:port] Send reports via specified HTTP proxy server. --syslog-udp [host:port] Send reports to remote syslog host. Send vulnerable, potentially vulnerable, and mitigated reports by default. --syslog-level [level] Send reports only if report is higher or equal to specified level. Specify alert for vulnerable and potentially vulnerable reports. Specify info for vulnerable, potentially vulnerable, and mitigated reports. Specify debug for vulnerable, potentially vulnerable, mitigated, and error reports. --syslog-facility [code] Default value is 16 (LOCAL0). Facility value must be in the range of 0 to 23 inclusive. --rfc5424 Follow RFC5424 The Syslog Protocol strictly. --report-csv Generate log4j2_scan_report_yyyyMMdd_HHmmss.csv in working directory if not specified otherwise via --report-path [path] --report-json Generate log4j2_scan_report_yyyyMMdd_HHmmss.json in working directory if not specified otherwise via --report-path [path] --report-patch Report also patched log4j file. --report-path Specify report output path including filename. Implies --report-csv. --report-dir Specify report output directory. Implies --report-csv. --no-empty-report Do not generate empty report. --csv-log-path Specify csv log file path. If log file exists, log will be appended. --json-log-path Specify json log file path. If log file exists, log will be appended. --old-exit-code Return sum of vulnerable and potentially vulnerable files as exit code. --debug Print exception stacktrace for debugging. --trace Print all directories and files while scanning. --silent Do not print progress message. --throttle Limit scan files per second. --help Print this help.

CVE-2021-44228-Scanner

인기

Log4j 위험 관리

다운로드

빌드

사용 방법

CVE-2021-44228-Scanner

인기

Log4j 위험 관리

다운로드

빌드

사용 방법