alexandreheroux / fix-cve-2021-44228

Apply class remove process from ear/war/jar/zip archive, see https://logging.apache.org/log4j/2.x/

CVE-2021-44228!

The current program remove the class "org/apache/logging/log4j/core/lookup/JndiLookup.class" from your zip, jar, war, ear archive.

Before use

• Follow the guide https://www.lunasec.io/docs/blog/log4j-zero-day-mitigation-guide/ before using.
• The utility will help your to apply "Modify your log4j .jar manually" step if required

How to run

Execute the program before starting your server

• wget https://github.com/AlexandreHeroux/Fix-CVE-2021-44228/raw/main/dist/fix-CVE-2021-44228-1.0.1.jar
• java -jar fix-CVE-2021-44228-1.0.1.jar /yourFolder

fix-cve-2021-44228's Issues

Does not support jar which are missing manifest file

Does not support jar which are missing manifest file

checking permission

Hello,

With v1.0.0 & v1.0.1, could you add a check permission to modify file ?

I have tried to execute this command without sudo
java -jar fix-CVE-2021-44228-1.0.0.jar /Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/share/OSGi-Bundles/

Starting scan of /Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/share/OSGi-Bundles
Exception in thread "main" java.io.IOException: cannot fix /Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/share/OSGi-Bundles/org.apache.logging.log4j.core-2.11.2.jar
at com.infinisolution.fix.BaseFix.scanArchive(BaseFix.java:70)
at com.infinisolution.fix.BaseFix.scan(BaseFix.java:46)
at com.infinisolution.fix.BaseFix.scan(BaseFix.java:43)
at com.infinisolution.fix.BaseFix.run(BaseFix.java:32)
at com.infinisolution.fix.cve202144228.FixCVE202144228.main(FixCVE202144228.java:24)

With sudo java -jar fix-CVE-2021-44228-1.0.0.jar /Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/share/OSGi-Bundles/
it is working :
Number of fixed files 1
/Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/share/OSGi-Bundles/org.apache.logging.log4j.core-2.11.2.jar

Add org/apache/log4j/net/JMSAppender.class

So far this works for log4j V2.

Would you mind adding "org/apache/log4j/net/JMSAppender.class" to MALICIOUS_FILES? This would help mitigating log4j V1 problems.