Log4-detector 是一個可以在任何應用程序中的文件系統(tǒng)上檢測易受攻擊的 Log4J 版本（CVE-2021-44228、CVE-2021-45046 等）的掃描程序。

甚至能夠找到隱藏在幾層深處的 Log4J 實例。適用于 Linux、Windows 和 Mac，也適用于 Java 運行的其他任何地方。

用法

java -jar log4j-detector-2021.12.22.jar 

Usage: java -jar log4j-detector-2021.12.22.jar [--verbose] [--json] [--stdin] [--exclude=X] [paths to scan...]

  --json       - Output STDOUT results in JSON.  (Errors/warning still emitted to STDERR)
  --stdin      - Read STDIN for paths to explore (one path per line)
  --exclude=X  - Where X is a JSON list containing full paths to exclude. Must be valid JSON.

                 Example: 

Exit codes:  0 = No vulnerable Log4J versions found.
             1 = At least one legacy Log4J 1.x version found.
             2 = At least one vulnerable Log4J version found.

About - MergeBase log4j detector (version 2021.12.22)
Docs  - https://github.com/mergebase/log4j-detector 
(C) Copyright 2021 Mergebase Software Inc. Licensed to you via GPLv3.

示例

java -jar log4j-detector-2021.12.22.jar [path-to-scan] > hits.txt

更多示例

java -jar log4j-detector-2021.12.22.jar ./samples 

-- github.com/mergebase/log4j-detector v2021.12.22 (by mergebase.com) analyzing paths (could take a while).
-- Note: specify the '--verbose' flag to have every file examined printed to STDERR.
/opt/mergebase/log4j-detector/samples/clt-1.0-SNAPSHOT.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/infinispan-embedded-query-8.2.12.Final.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-1.1.3.jar contains Log4J-1.x   <= 1.2.17 _OLD_
/opt/mergebase/log4j-detector/samples/log4j-1.2.13.jar contains Log4J-1.x   <= 1.2.17 _OLD_
/opt/mergebase/log4j-detector/samples/log4j-1.2.17.jar contains Log4J-1.x   <= 1.2.17 _OLD_
/opt/mergebase/log4j-detector/samples/log4j-core-2.0-beta2.jar contains Log4J-2.x   <= 2.0-beta8 _POTENTIALLY_SAFE_ (or did you already remove JndiLookup.class?) 
/opt/mergebase/log4j-detector/samples/log4j-core-2.0-beta9.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.0.2.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.0.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.10.0.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.12.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.12.2.jar contains Log4J-2.x   == 2.12.2 _OKAY_
/opt/mergebase/log4j-detector/samples/log4j-core-2.12.3.jar contains Log4J-2.x   >= 2.12.3 _SAFE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.14.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.15.0.jar contains Log4J-2.x   == 2.15.0 _OKAY_
/opt/mergebase/log4j-detector/samples/log4j-core-2.16.0.jar contains Log4J-2.x   == 2.16.0 _OKAY_
/opt/mergebase/log4j-detector/samples/log4j-core-2.17.0.jar contains Log4J-2.x   >= 2.17.0 _SAFE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.3.1.jar contains Log4J-2.x   == 2.3.1 _SAFE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.4.1.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.9.1.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_

掃描結(jié)果

Log4-detector 會將 log4j-core 版本 2.3.1、2.12.3 和 2.17.0 報告為 _SAFE_ ，將2.12.2、2.15.0和 2.16.0 報告為_OKAY_，將所有其他版本 報告為 _VULNERABLE_，將舊的log4j-1.x版本報告為 _OLD_。

可以正確檢測可執(zhí)行 spring-boot jars/wars 中的 log4j、混合到 uber jars 中的依賴項、shaded jars，甚至是未壓縮的jar 文件(又名*.class)。

• _VULNERABLE_?-> 需要升級或刪除此文件。
• _OKAY_?-> 僅針對 Log4J 版本 2.12.2、2.15.0 和 2.16.0 報告此問題，建議升級到 2.17.0。
• _SAFE_?-> 目前僅針對 Log4J 版本 2.3.1、2.12.3 和 2.17.0（及更高版本）報告此問題。
• _OLD_?-> 可以免受 CVE-2021-44228 的影響，但應該計劃升級，因為 Log4J 1.2.x 已經(jīng)停產(chǎn) 7 年并且有幾個已知的漏洞。
• _POTENTIALLY_SAFE_?-> “JndiLookup.class”文件不存在，要么是因為您的 Log4J 版本很舊（2.0-beta9 之前），要么因為有人已經(jīng)刪除了這個文件。如果是這種情況，請確保是團隊或公司的成員刪除“JndiLookup.class”，因為攻擊者會自己刪除此文件，以防止其他競爭攻擊者獲得對受感染系統(tǒng)的訪問權限。