Comments (15)
Throw those files into a zip file. :-)
But I plan to fix the tool to detect unzipped Log4J, too (a rare but not impossible scenario). Stay tuned.
from log4j-detector.
we had the problem that about half of our jar files silently failed. the jar's within were never scanned, and the verbose flag confirmed that they weren't found by the tool. hence the attempt to unzip first
from log4j-detector.
@juliusmusseau this is what happens with the project in question. freshly built jar from jdk 8. sadly cannot share because it's closed source:
(.pyenv) ➜ docker git:(master) ✗ ls -lA
total 145056
-rwxr--r-- 1 user staff 74268625 Dec 13 17:45 application.jar
(.pyenv) ➜ docker git:(master) ✗ java -jar ~/Downloads/log4j-detector-2021.12.13.jar . --verbose
-- Analyzing paths (could take a long time).
-- Note: specify the '--verbose' flag to have every file examined printed to STDERR.
-- Examining ./application.jar...
-- No vulnerable Log4J 2.x samples found in supplied paths: [.]
-- Congratulations, the supplied paths are not vulnerable to CVE-2021-44228 ! :-)
(.pyenv) ➜ docker git:(master) ✗ unzip application.jar >/dev/null 2>/dev/null
(.pyenv) ➜ docker git:(master) ✗ find . -iname '*.jar' | wc -l
202
(.pyenv) ➜ docker git:(master) ✗
subsequently calling the script with --verbose
does scan all the 202 jar files. but recursion is definitely not working here
from log4j-detector.
Can you try now? (Do a "git pull --rebase" first, or re-download the log4j-detector-2021.12.13.jar). I added some additional logging messages to get a better sense of what is going on.
from log4j-detector.
same result
(.pyenv) ➜ docker git:(master) ✗ rm -rf BOOT-INF META-INF org
(.pyenv) ➜ docker git:(master) ✗ java -jar ~/Downloads/log4j-detector-2021.12.13.jar . --verbose
-- Analyzing paths (could take a long time).
-- Note: specify the '--verbose' flag to have every file examined printed to STDERR.
-- Examining ./application.jar...
-- No vulnerable Log4J 2.x samples found in supplied paths: [.]
-- Congratulations, the supplied paths are not vulnerable to CVE-2021-44228 ! :-)
(.pyenv) ➜ docker git:(master) ✗ md5 ~/Downloads/log4j-detector-2021.12.13.jar
MD5 (/Users/user/Downloads/log4j-detector-2021.12.13.jar) = 26ddfb12004b3ba7a6261e33a9d49efb
from log4j-detector.
This one is real Java koan ! I've been meditating on it all morning.
Can you try with latest version and add the new "--debug" flag I've added, and see if that gives you any ideas for what might be going wrong?
(I also rejigged the way inner zip files are detected, but I think there's only a small 10% chance that actually fixes things here.)
Note: --debug really causes a lot of noise on STDERR. Sorry !
from log4j-detector.
in my case it dont recognize jar files with the affected log4j versions, for example 2.14.1?
I tested with several examples and everytime says " No vulnerable Log4J 2.x samples found "
from log4j-detector.
@datacamp461 - are you able to share a sample with me that I can test in my lab?
from log4j-detector.
in my case the debug flag doesn't print anything at all. a previous version didn't recognize the flag and threw an error but now the output is exactly the same with or without
from log4j-detector.
@yspreen - that's actually helpful!
It's supposed to print things like this (for every entry inside the zip):
-- DEBUG - /var/tmp/l/l.zip!/l/2.0-alpha1/org/apache/logging/log4j/core/config/NullConfiguration.class size=895 isZip=false isClass=true
-- DEBUG - /var/tmp/l/l.zip!/l/2.0-alpha1/META-INF/maven/org.apache.logging.log4j/log4j-core/pom.properties size=124 isZip=false isClass=false
-- DEBUG - /var/tmp/l/l.zip!/l/2.0-alpha1/log4j-core-2.0-alpha1.jar size=375010 isZip=true isClass=false
from log4j-detector.
from log4j-detector.
Any chance your jar file is a spring-boot executable jar ?
from log4j-detector.
Any chance your jar file is a spring-boot executable jar ?
I can confirm on this: a spring-boot executable jar file does NOT get recognized by this tool!
from log4j-detector.
from log4j-detector.
I think this is fixed now !
from log4j-detector.
Related Issues (20)
- Detection of potentially safe log4j 1.x after manual mitigation HOT 1
- fix --exclude example in README HOT 4
- Shaded Log4j class JndiLookup not found HOT 7
- java.util.zip.ZipException: invalid entry size (expected 0 but got 622 bytes) HOT 4
- version 2021.12.20 not redirecting output anymore (in Windows) HOT 1
- Simple test using sample files outputs no status HOT 10
- Detection of Log4j 1.x as vulnerable HOT 5
- great idea but can be enhanced
- Some archives are not detected when using Java 8
- Scan OSGI .kar and .par archives HOT 1
- Scan .car files HOT 1
- New log4j 2.17.0 CVE that can lead to RCE HOT 1
- log4j CVEs
- Output fixing / adjustment HOT 2
- IDEA: Show a _SAFE_ when nothing found
- Don't handle *.gwtar and other normal files ending with *ar as archives HOT 2
- Incomplete pathnames HOT 1
- Weird new File("blah") in nextByte HOT 3
- Exploded jar not detected under Windows
- reload4j raised as log4j-1.x vulnerability
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from log4j-detector.