Skip to content

Commit 7f8b17b

Browse files
johspaethjohspaeth
authored
Merge pull request #2 from CodeShield-Security/addProcessCheck
add process check
2 parents 48e4b9b + 7a35580 commit 7f8b17b

File tree

3 files changed

+202
-116
lines changed

3 files changed

+202
-116
lines changed

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,13 @@ CVE-2021-44228 found declared as dependency in META-INF/maven/org.apache.logging
1717
CVE-2021-44228 found in class file org/apache/logging/log4j/core/net/JndiManager$1.class
1818
```
1919

20+
## How to run this tool on a live server (no need to stop your running Java instances)
21+
22+
1. Download the [jar file](https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector/releases/download/v0.5/Log4JDetector-0.5-jar-with-dependencies.jar) under releases.
23+
2. Run `java -cp <PATH_TO_DOWNLOADED_JAR> de.codeshield.log4jshell.Log4JProcessDetector`
24+
3. The jar searches the classpath of all running java processes for vulnerable log4j instances
25+
26+
2027
## Background on CVE-2021-44228
2128
A serious Remote Code Execution vulnerability has been discovered within log4j and version 2.0-beta9 to 2.14 are affected. The vulnerability has been classified as critical, as it affected log4j one of the most used logging libraries for Java. There are many references and article out there.
2229

‎pom.xml‎

Lines changed: 122 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -1,126 +1,132 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22

33
<project xmlns="http://maven.apache.org/POM/4.0.0"
4-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5-
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
6-
<modelVersion>4.0.0</modelVersion>
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
6+
<modelVersion>4.0.0</modelVersion>
77

8-
<groupId>de.codeshield.log4shell</groupId>
9-
<artifactId>Log4JDetector</artifactId>
10-
<version>0.4</version>
8+
<groupId>de.codeshield.log4shell</groupId>
9+
<artifactId>Log4JDetector</artifactId>
10+
<version>0.4</version>
1111

12-
<name>cve-2021-44228-detector</name>
13-
<url>https://codeshield.io</url>
12+
<name>cve-2021-44228-detector</name>
13+
<url>https://codeshield.io</url>
1414

15-
<properties>
16-
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
17-
<maven.compiler.source>1.7</maven.compiler.source>
18-
<maven.compiler.target>1.7</maven.compiler.target>
19-
</properties>
15+
<properties>
16+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
17+
<maven.compiler.source>1.8</maven.compiler.source>
18+
<maven.compiler.target>1.8</maven.compiler.target>
19+
</properties>
2020

21-
<dependencies>
22-
<dependency>
23-
<groupId>junit</groupId>
24-
<artifactId>junit</artifactId>
25-
<version>4.13.1</version>
26-
<scope>test</scope>
27-
</dependency>
28-
<dependency>
29-
<groupId>org.apache.maven</groupId>
30-
<artifactId>maven-model</artifactId>
31-
<version>3.8.4</version>
32-
</dependency>
33-
<dependency>
34-
<groupId>commons-io</groupId>
35-
<artifactId>commons-io</artifactId>
36-
<version>2.11.0</version>
37-
</dependency>
38-
<!-- https://mvnrepository.com/artifact/org.apache.maven/maven-project -->
39-
<dependency>
40-
<groupId>org.apache.maven</groupId>
41-
<artifactId>maven-project</artifactId>
42-
<version>2.2.1</version>
43-
</dependency>
44-
<!-- https://mvnrepository.com/artifact/commons-codec/commons-codec -->
45-
<dependency>
46-
<groupId>commons-codec</groupId>
47-
<artifactId>commons-codec</artifactId>
48-
<version>1.15</version>
49-
</dependency>
21+
<dependencies>
22+
<dependency>
23+
<groupId>junit</groupId>
24+
<artifactId>junit</artifactId>
25+
<version>4.13.1</version>
26+
<scope>test</scope>
27+
</dependency>
28+
<dependency>
29+
<groupId>org.apache.maven</groupId>
30+
<artifactId>maven-model</artifactId>
31+
<version>3.8.4</version>
32+
</dependency>
33+
<dependency>
34+
<groupId>commons-io</groupId>
35+
<artifactId>commons-io</artifactId>
36+
<version>2.11.0</version>
37+
</dependency>
38+
<!-- https://mvnrepository.com/artifact/org.apache.maven/maven-project -->
39+
<dependency>
40+
<groupId>org.apache.maven</groupId>
41+
<artifactId>maven-project</artifactId>
42+
<version>2.2.1</version>
43+
</dependency>
44+
<!-- https://mvnrepository.com/artifact/commons-codec/commons-codec -->
45+
<dependency>
46+
<groupId>commons-codec</groupId>
47+
<artifactId>commons-codec</artifactId>
48+
<version>1.15</version>
49+
</dependency>
5050

51-
<dependency>
52-
<groupId>com.opencsv</groupId>
53-
<artifactId>opencsv</artifactId>
54-
<version>5.5.2</version>
55-
</dependency>
56-
</dependencies>
51+
<dependency>
52+
<groupId>com.opencsv</groupId>
53+
<artifactId>opencsv</artifactId>
54+
<version>5.5.2</version>
55+
</dependency>
56+
<dependency>
57+
<groupId>commons-lang</groupId>
58+
<artifactId>commons-lang</artifactId>
59+
<version>2.6</version>
60+
<scope>compile</scope>
61+
</dependency>
62+
</dependencies>
5763

58-
<build>
59-
<plugins>
60-
<plugin>
61-
<artifactId>maven-assembly-plugin</artifactId>
62-
<configuration>
63-
<archive>
64-
<manifest>
65-
<mainClass>de.codeshield.log4jshell.Log4JDetector</mainClass>
66-
</manifest>
67-
</archive>
68-
<descriptorRefs>
69-
<descriptorRef>jar-with-dependencies</descriptorRef>
70-
</descriptorRefs>
71-
</configuration>
72-
</plugin>
73-
<plugin>
74-
<groupId>org.apache.maven.plugins</groupId>
75-
<artifactId>maven-compiler-plugin</artifactId>
76-
<configuration>
77-
<source>8</source>
78-
<target>8</target>
79-
</configuration>
80-
</plugin>
81-
</plugins>
82-
<pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
83-
<plugins>
84-
<!-- clean lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#clean_Lifecycle -->
85-
<plugin>
86-
<artifactId>maven-clean-plugin</artifactId>
87-
<version>3.1.0</version>
88-
</plugin>
89-
<!-- default lifecycle, jar packaging: see https://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_jar_packaging -->
90-
<plugin>
91-
<artifactId>maven-resources-plugin</artifactId>
92-
<version>3.0.2</version>
93-
</plugin>
94-
<plugin>
95-
<artifactId>maven-compiler-plugin</artifactId>
96-
<version>3.8.0</version>
97-
</plugin>
98-
<plugin>
99-
<artifactId>maven-surefire-plugin</artifactId>
100-
<version>2.22.1</version>
101-
</plugin>
102-
<plugin>
103-
<artifactId>maven-jar-plugin</artifactId>
104-
<version>3.0.2</version>
105-
</plugin>
106-
<plugin>
107-
<artifactId>maven-install-plugin</artifactId>
108-
<version>2.5.2</version>
109-
</plugin>
110-
<plugin>
111-
<artifactId>maven-deploy-plugin</artifactId>
112-
<version>2.8.2</version>
113-
</plugin>
114-
<!-- site lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#site_Lifecycle -->
115-
<plugin>
116-
<artifactId>maven-site-plugin</artifactId>
117-
<version>3.7.1</version>
118-
</plugin>
119-
<plugin>
120-
<artifactId>maven-project-info-reports-plugin</artifactId>
121-
<version>3.0.0</version>
122-
</plugin>
123-
</plugins>
124-
</pluginManagement>
125-
</build>
64+
<build>
65+
<plugins>
66+
<plugin>
67+
<artifactId>maven-assembly-plugin</artifactId>
68+
<configuration>
69+
<archive>
70+
<manifest>
71+
<mainClass>de.codeshield.log4jshell.Log4JDetector</mainClass>
72+
</manifest>
73+
</archive>
74+
<descriptorRefs>
75+
<descriptorRef>jar-with-dependencies</descriptorRef>
76+
</descriptorRefs>
77+
</configuration>
78+
</plugin>
79+
<plugin>
80+
<groupId>org.apache.maven.plugins</groupId>
81+
<artifactId>maven-compiler-plugin</artifactId>
82+
<configuration>
83+
<source>8</source>
84+
<target>8</target>
85+
</configuration>
86+
</plugin>
87+
</plugins>
88+
<pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
89+
<plugins>
90+
<!-- clean lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#clean_Lifecycle -->
91+
<plugin>
92+
<artifactId>maven-clean-plugin</artifactId>
93+
<version>3.1.0</version>
94+
</plugin>
95+
<!-- default lifecycle, jar packaging: see https://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_jar_packaging -->
96+
<plugin>
97+
<artifactId>maven-resources-plugin</artifactId>
98+
<version>3.0.2</version>
99+
</plugin>
100+
<plugin>
101+
<artifactId>maven-compiler-plugin</artifactId>
102+
<version>3.8.0</version>
103+
</plugin>
104+
<plugin>
105+
<artifactId>maven-surefire-plugin</artifactId>
106+
<version>2.22.1</version>
107+
</plugin>
108+
<plugin>
109+
<artifactId>maven-jar-plugin</artifactId>
110+
<version>3.0.2</version>
111+
</plugin>
112+
<plugin>
113+
<artifactId>maven-install-plugin</artifactId>
114+
<version>2.5.2</version>
115+
</plugin>
116+
<plugin>
117+
<artifactId>maven-deploy-plugin</artifactId>
118+
<version>2.8.2</version>
119+
</plugin>
120+
<!-- site lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#site_Lifecycle -->
121+
<plugin>
122+
<artifactId>maven-site-plugin</artifactId>
123+
<version>3.7.1</version>
124+
</plugin>
125+
<plugin>
126+
<artifactId>maven-project-info-reports-plugin</artifactId>
127+
<version>3.0.0</version>
128+
</plugin>
129+
</plugins>
130+
</pluginManagement>
131+
</build>
126132
</project>

‎src/main/java/de/codeshield/log4jshell/Log4JProcessDetector.java‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
package de.codeshield.log4jshell;
2+
3+
import org.apache.commons.lang.StringUtils;
4+
5+
import java.io.BufferedReader;
6+
import java.io.File;
7+
import java.io.IOException;
8+
import java.io.InputStreamReader;
9+
import java.util.ArrayList;
10+
import java.util.Arrays;
11+
import java.util.List;
12+
import java.util.stream.Collectors;
13+
14+
public class Log4JProcessDetector {
15+
16+
public static void main(String[] args) throws IOException {
17+
18+
// grep process (works on mac and linux)
19+
List<String> commands = new ArrayList<String>();
20+
commands.add("/bin/sh");
21+
commands.add("-c");
22+
commands.add("ps -ef | grep java");
23+
24+
Process process = new ProcessBuilder(commands).start();
25+
BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream()));
26+
StringBuilder builder = new StringBuilder();
27+
List<String> lines = new ArrayList<>();
28+
String line = null;
29+
while ((line = reader.readLine()) != null) {
30+
lines.add(line);
31+
}
32+
String result = builder.toString();
33+
34+
// analyze each output
35+
// search for the "-classpath" parameter
36+
for (String outputLine : lines) {
37+
String searchStr = "-classpath";
38+
int i = StringUtils.indexOf(outputLine, searchStr);
39+
if (i == -1) {
40+
// check if someone used -cp
41+
searchStr = "-cp";
42+
i = StringUtils.indexOf(outputLine, searchStr);
43+
}
44+
45+
if (i > 0) {
46+
String cpArgs = outputLine.substring(i + searchStr.length() + 1);
47+
48+
// scan for jar files
49+
String[] cpArgsSplit = cpArgs.split(File.pathSeparator);
50+
final List<String> foundJarsOnCp =
51+
Arrays.stream(cpArgsSplit)
52+
.map(x -> StringUtils.substring(x, 0, StringUtils.indexOf(x, ".jar") + 4))
53+
.collect(Collectors.toList());
54+
55+
for (String jarFile : foundJarsOnCp) {
56+
try {
57+
Log4JDetector detector = new Log4JDetector();
58+
System.out.println("Scanning jar file " + jarFile);
59+
// detector.run(jarFile);
60+
} catch (Exception e){
61+
System.out.println("Could not scan jar file " + jarFile);
62+
}
63+
}
64+
65+
} else {
66+
// no classpath arg found
67+
continue;
68+
}
69+
}
70+
71+
System.out.println(result);
72+
}
73+
}

0 commit comments

Comments
 (0)