log4j2-scan 是一款用于 CVE-2021-44228 漏洞扫描和缓解修复的单一二进制命令行工具。它还支持嵌套 JAR 文件扫描和修复。此外，它还能检测 CVE-2021-45046 (log4j 2.15.0)、CVE-2021-45105 (log4j 2.16.0)、CVE-2021-44832 (log4j 2.17.0)、CVE-2021-4104、CVE-2019-17571、CVE-2017-5645、CVE-2020-9488、CVE-2022-23302、CVE-2022-23305、CVE-2022-23307 (log4j 1.x) 和 CVE-2021-42550 (logback 0.9-1.2.7) 漏洞。
您可以将 log4j2-scan 与 Logpresso Watch 服务集成，用于报告和补丁管理。请访问 https://logpresso.watch 了解详情。
VCRUNTIME140.dll not found 错误，请安装 Visual C++ Redistributable。只需使用目标目录路径运行 log4j2-scan.exe 或 log4j2-scan 即可。logpresso-log4j2-scan.jar 应与 JRE/JDK 7+ 兼容。
--fix 选项支持修复以下漏洞：
--fix 选项无法缓解以下漏洞：
用法
Logpresso CVE-2021-44228 Vulnerability Scanner 3.0.1 (2022-02-13)
Usage: log4j2-scan [--scan-log4j1] [--fix] target_path1 target_path2
-f [config_file_path]
Specify config file path which contains scan target paths.
Paths should be separated by new line. Prepend # for comment.
--scan-log4j1
Enables scanning for log4j 1 versions.
--scan-logback
Enables scanning for logback CVE-2021-42550.
--scan-zip
Scan also .zip extension files. This option may slow down scanning.
--zip-charset
Specify an alternate zip encoding other than utf-8. System default charset is used if not specified.
--fix
Backup original file and remove JndiLookup.class from JAR recursively.
With --scan-log4j1 option, it also removes JMSAppender.class, SocketServer.class, SMTPAppender.class, SMTPAppender$1.class,
JMSSink.class, JDBCAppender.class, and all classes of org.apache.log4j.chainsaw package
--force-fix
Do not prompt confirmation. Don't use this option unless you know what you are doing.
--restore [backup_file_path]
Unfix JAR files using zip archived file.
--backup-path [zip_output_path]
Specify backup file path.
--backup-ext [zip]
Specify backup file extension. zip by default.
If --backup-path is specified, this option is ignored.
--all-drives
Scan all drives on Windows
--drives c,d
Scan specified drives on Windows. Spaces are not allowed here.
--no-symlink
Do not detect symlink as vulnerable file.
--exclude [path_prefix]
Path prefixes of directories whose absolute path starts with the specified value will be excluded.
Does not support relative paths. You can specify multiple --exclude [path_prefix] pairs
--exclude-config [config_file_path]
Specify exclude path prefix list in text file. Paths should be separated by new line. Prepend # for comment.
--exclude-pattern [pattern]
Exclude specified paths of directories by pattern. Supports fragments.
You can specify multiple --exclude-pattern [pattern] pairs (non regex)
--exclude-file-config [config_file_path]
Specify exclude file path list in text file. Paths should be separated by new line. Prepend # for comment.
--exclude-fs nfs,tmpfs
Exclude paths by file system type. nfs, nfs3, nfs4, afs, cifs, autofs,
tmpfs, devtmpfs, fuse.sshfs, smbfs and iso9660 is ignored by default.
--api-key [key]
Send reports to Logpresso Watch service.
--http-proxy [addr:port]
Send reports via specified HTTP proxy server.
--syslog-udp [host:port]
Send reports to remote syslog host.
Send vulnerable, potentially vulnerable, and mitigated reports by default.
--syslog-level [level]
Send reports only if report is higher or equal to specified level.
Specify alert for vulnerable and potentially vulnerable reports.
Specify info for vulnerable, potentially vulnerable, and mitigated reports.
Specify debug for vulnerable, potentially vulnerable, mitigated, and error reports.
--syslog-facility [code]
Default value is 16 (LOCAL0). Facility value must be in the range of 0 to 23 inclusive.
--rfc5424
Follow RFC5424 The Syslog Protocol strictly.
--report-csv
Generate log4j2_scan_report_yyyyMMdd_HHmmss.csv in working directory if not specified otherwise via --report-path [path]
--report-json
Generate log4j2_scan_report_yyyyMMdd_HHmmss.json in working directory if not specified otherwise via --report-path [path]
--report-patch
Report also patched log4j file.
--report-path
Specify report output path including filename. Implies --report-csv.
--report-dir
Specify report output directory. Implies --report-csv.
--no-empty-report
Do not generate empty report.
--csv-log-path
Specify csv log file path. If log file exists, log will be appended.
--json-log-path
Specify json log file path. If log file exists, log will be appended.
--old-exit-code
Return sum of vulnerable and potentially vulnerable files as exit code.
--debug
Print exception stacktrace for debugging.
--trace
Print all directories and files while scanning.
--silent
Do not print progress message.
--throttle
Limit scan files per second.
--help
Print this help.
在 Windows 上
log4j2-scan [--fix] target_path
在 Linux 上
./log4j2-scan [--fix] target_path
在 UNIX（AIX、Solaris 等）上
java -jar logpresso-log4j2-scan-3.0.1.jar [--fix] target_path
如果添加 --fix 选项，此程序会将存在漏洞的原始 JAR 文件复制为 .bak 文件，并创建不包含 org/apache/logging/log4j/core/lookup/JndiLookup.class 条目的新 JAR 文件。所有 .bak 文件将被归档到名为 log4j2_scan_backup_yyyyMMdd_HHmmss.zip 的单个 zip 文件中，然后安全删除。在大多数环境中，JNDI 查找功能不会被使用。但是，您必须自行承担使用此选项的风险。您可以使用 --restore 选项轻松还原存在漏洞的原始 JAR 文件。
根据操作系统的不同：
如果您想自动化修复任务，请使用 --force-fix 选项。启用此选项后，程序将不再提示确认。
如果 JAR 文件中已移除 org/apache/logging/log4j/core/lookup/JndiLookup.class 条目，将显示 (mitigated) 标记。
如果添加 --trace 选项，此程序将打印所有访问过的目录和文件。请仅在调试时使用此选项。