dtact / divd-2021-00038--log4j-scanner

Scan systems and docker images for potential log4j vulnerabilities. Able to patch (remove JndiLookup.class) from layered archives. Will detect in-depth (layered archives jar/zip/tar/war and scans for vulnerable Log4J versions (CVE-2021-44228, CVE-2021-45046 and CVE-2021-45105). Binaries for Windows, Linux and OsX, but can be build on each platform supported by supported Golang.

divd-2021-00038--log4j-scanner

This scanner will recursively scan paths including archives for vulnerable log4j versions and org/apache/logging/log4j/core/lookup/JndiLookup.class files.

Currently the allow list defines non exploitable versions, in this case log4j-core 2.17.0 and 2.12.3.

Features

• scans recursively through all archives in archives in archives in archives etc
• scan for known log4j libraries (sha256 hash)
• scan for JndiLookup.class files
• fast
• show related CVE's found by version
• detects class files with different extensions (eg .ezclass)
• scans through all layers of local- and remote docker images
• binary versions available for Windows, Linux and MacOS
• includes patching, which will delete (again recursively) the JndiLookup class

References

CVE	References
CVE-2021-44228	https://www.cve.org/CVERecord?id=CVE-2021-44228
CVE-2021-45046	https://www.cve.org/CVERecord?id=CVE-2021-45046
CVE-2021-45105	https://www.cve.org/CVERecord?id=CVE-2021-45105
CVE-2021-44832	https://www.cve.org/CVERecord?id=CVE-2021-44832

Scanning

Usage

Windows

$ divd-2021-00038--log4j-scanner.exe {target-path}

Linux / OSX / FreeBSD

$ divd-2021-00038--log4j-scanner {target-path}

Docker containers

Using the tool you can now also scan containers:

$ ./divd-2021-00038--log4j-scanner scan-image logstash:7.16.1

or local images:

$ ./divd-2021-00038--log4j-scanner scan-image --local {sha256|pattern}
$ ./divd-2021-00038--log4j-scanner scan-image --local log4shell:latest
$ ./divd-2021-00038--log4j-scanner scan-image --local 4949add9e671

# scan all local images
$ ./divd-2021-00038--log4j-scanner scan-image --local 

You can also patch the image:

$ docker save log4shell > ./log4shell-image.tar
$ ./divd-2021-00038--log4j-scanner ./log4shell-image.tar
$ ./divd-2021-00038--log4j-scanner patch ./log4shell-image.tar
$ cat ./log4shell-image.tar.patch | docker load 

Comparing both tars will give the following differences:

Binary files ../2/BOOT-INF/lib/log4j-core-2.14.1.jar and ./BOOT-INF/lib/log4j-core-2.14.1.jar differ
Binary files ../2/app/spring-boot-application.jar and ./app/spring-boot-application.jar differ
Binary files ../2/b0d66ac73d47865118cfb9a1244f1508d94ea938da1eb78c2db20bd2e1a6629a/layer.tar and ./b0d66ac73d47865118cfb9a1244f1508d94ea938da1eb78c2db20bd2e1a6629a/layer.tar differ
Only in ./org/apache/logging/log4j/core/lookup: JndiLookup.class

Patching

We've added preleminary support for recursively patching files. This is very experimental, be careful with this feature. Currently patching only works with the archive (jar / tar ) file. The patch will create a new `.patch`` file that needs to replace the original file. This is on purpose a manual process, as it needs to be timed with restarting services. Make sure you'll create a backup of the original file before replacing it. After patching you can scan again to make sure you didn't miss any files. Currently plain .class files in folders won't be patched, as they can be removed safe manually.

The .patch file will be exactly the same as the original file, without JndiLookup.class. This should be sufficient to mitigate this issue, while waiting for upgrades. Make sure to make backups and test thoroughly.

Patch will refuse to run on folders, as a precaution. Just point patch to the vulnerable archive.

Usage

Windows

$ divd-2021-00038--log4j-scanner.exe patch {target-path}

Linux / OSX / FreeBSD

divd-2021-00038--log4j-scanner patch {target-path}

Build from source

Requirements:

• Go 1.16 or newer

For development

$ git clone "https://github.com/dtact/divd-2021-00038--log4j-scanner.git"
$ go build -o ./.builds/divd-2021-00038--log4j-scanner ./main.go

Copyright and license

Code and documentation copyright 2021 Remco Verhoef (DTACT).

Code released under the MIT license.

divd-2021-00038--log4j-scanner's Issues

Cannot find module for path io/fs

Could it be that a module dependency for path io/fs is missing?

Trying to run the code I get the following error:

$ go run .
build github.com/dutchcoders/divd-2021-00038--log4j-scanner: cannot find module for path io/fs

I have absolutely 0 experience with Golang, so forgive me if this is just an user error.

Support for Docker version 18.06.1-ce

I tried to run the scan for all local docker images. My docker daemon is Docker version 18.06.1-ce. I get the below error.
Will there be too much of a difference between 1.40 and 1.38 to not support ?

root@services-test:~# docker --version
Docker version 18.06.1-ce, build e68fc7a

root@services-test:~# ./divd-2021-00038--log4j-scanner scan-image --local
divd-2021-00038--log4j-scanner by DTACT
http://github.com/dtact/divd-2021-00038--log4j-scanner
--------------------------------------
[ ] Currently scanning , checked 0 images in 00h:00m:00s. 
[!] Error identifying application: Error response from daemon: client version 1.40 is too new. Maximum supported API version is 1.38

root@services-test:~# cat /etc/os-release
NAME="RancherOS"
VERSION=v1.5.0
ID=rancheros
ID_LIKE=
VERSION_ID=v1.5.0
PRETTY_NAME="RancherOS v1.5.0"
HOME_URL="http://rancher.com/rancher-os/"
SUPPORT_URL="https://forums.rancher.com/c/rancher-os"
BUG_REPORT_URL="https://github.com/rancher/os/issues"
BUILD_ID=

Avoid unlikely directories by default

If you scan the full filesystem under Linux, the tool also scans e.g., /sys/. I think it's better to skip some paths by default.

Exclude file path option?

Is it possible to add a flag to exclude certain paths?
We would like to avoid scanning large directories with data files that reside in the same root path with the applications.
thank you for your great work

2.17.0 is coming a vulnurable

I tried scanning a docker image and it is showing it vulnurable but log4j version 2.17.0 is used

[!][ ] found org/apache/logging/log4j/core/lookup/JndiLookup.class with hash xxxxxxxxxxx (identified as version(s): 2.17.0, 2.17.1)
└───────> found in WEB-INF/lib/log4j-core-2.17.0.jar
└───────> found in opt/app/app.war hash=xxxxxxxxxxx
└───────> found in xxxxxxxxxx/layer.tar

Log file

Would it be possible to add a cmd line switch for logfile (containing INFO and ERROR)? Perhaps a separate log file for vulnerable libraries too.

panic: runtime error: invalid memory address or nil pointer dereference

Running on Darwin.
The scanner crashed while scanning a large fileset.
[!][/xxxxxx/xxxxxx/xxxxxx/Library/Caches/Homebrew/downloads/2ac97b815131569d7888e06425f3446be8b2e68f8361ce20c65051f66cb23360--qt--6.2.2.monterey.bottle.tar.gz -> qt/6.2.2/share/qt/mkspecs/features/link_pkgconfig.prf] could not open zip file 1fe46b14df7175167596e630a8b1160a3e3e82d7bf62299b3acebd689a83675b panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x112eee8]

false postive from JndiLookup class

This is likely to be because it doesn't look at the search path com.intellij vs org.apache

https://youtrack.jetbrains.com/issue/IDEA-285807

2.16 is detected as vulnerable

C:\Users\x\Downloads>dir .\l4j-test\
 Volume in drive C is Windows
 Volume Serial Number is x-x

 Directory of C:\Users\x\Downloads\l4j-test

14.12.2021  17:42    <DIR>          .
14.12.2021  17:42    <DIR>          ..
12.12.2021  23:35         1,789,565 log4j-core-2.16.0.jar
               1 File(s)      1,789,565 bytes
               2 Dir(s)  403,926,196,224 bytes free

C:\Users\x\Downloads>divd-2021-00038--log4j-scanner-windows-amd64.exe .\l4j-test\
divd-2021-00038--log4j-scanner by DTACT
http://github.com/dtact/divd-2021-00038--log4j-scanner

[ ] Using targets: .\l4j-test\
[!][l4j-test\log4j-core-2.16.0.jar -> org/apache/logging/log4j/core/lookup/JndiLookup.class] found JndiLookup.class with hash 085e0b34e40533015ba6a73e85933472702654e471c32f276e76cffcf7b13869 (version: )
[🏎]: Scan finished! 1 files scanned, 1 vulnerable files found, 0 vulnerable libraries found, 0 errors occured,  in 00h0
0m00s, average rate is: 649 files/min.

C:\Users\x\Downloads>