Skip to content

Instantly share code, notes, and snippets.

@bdw429s
Last active February 23, 2022 22:50
Show Gist options
  • Save bdw429s/f55595d1a413d68a9c792eeced365e4a to your computer and use it in GitHub Desktop.
Save bdw429s/f55595d1a413d68a9c792eeced365e4a to your computer and use it in GitHub Desktop.
Scan a folder of jars recursively for CVE-2021-44228 vulnerability
/**
* Scan all jars in folder recursivley for log4j vuln
*/
component {
property name="progressableDownloader" inject="ProgressableDownloader";
property name="progressBar" inject="ProgressBar";
/**
* @scanPath absolute or relative path to folder to look for jars
*/
function run( scanPath='' ) {
var scannerJarPath = resolvePath( 'Log4JDetector-0.7.3-jar-with-dependencies.jar' );
if( !fileExists( scannerJarPath ) ) {
progressableDownloader.download(
'https://github.com/CodeShield-Security/Log4JShell-Bytecode-Detector/releases/download/v0.7.3/Log4JDetector-0.7.3-jar-with-dependencies.jar',
scannerJarPath,
function( status ) {
progressBar.update( argumentCollection = status );
}
);
}
scanPath = resolvePath( scanPath );
var jarList = directorylist( scanPath, true, 'array', '*.jar' );
if( !jarList.len() ) {
print.redLine( 'No jars found in [#scanPath#]' )
}
jarList.each( (j)=>{
try {
var output = command( 'run' )
.params( 'java -cp "#scannerJarPath#" de.codeshield.log4jshell.Log4JDetector "#j#"' )
.run( returnOutput=true );
} catch( any e ) {
output = e.message;
}
print
.line( output.replaceNoCase( scanPath, '' ), ( output contains 'not affected' ? 'green' : 'red' ) )
.toConsole();
} );
print.greenLine( 'Done!' );
}
}
@bdw429s
Copy link
Author

bdw429s commented Dec 13, 2021

Run the task like so in CommandBox:

task run :scanPath="D:\path\to\jars"

@bdw429s
Copy link
Author

bdw429s commented Dec 13, 2021

Please note, if you run your Adobe ColdFusion or Lucee servers via CommandBox you can apply the JVM arg to mitigate against this vuln globally like so

config set server.defaults.jvm.args='-Dlog4j2.formatMsgNoLookups=true'

And then restart any running servers.

@bdw429s
Copy link
Author

bdw429s commented Dec 15, 2021

An update to my previous comment- Log4j has now announced that adding the JVM arg is not sufficient to protect a vulnerable version of Log4j.
https://logging.apache.org/log4j/2.x/security.html
The only fix outside of updating the jar to 2.16 is to completely remove the JNDI class from the jar. You can do so with an archive program like Winzip or 7Zip. Adobe shows some methods to do this here:
https://helpx.adobe.com/coldfusion/kb/log4j-vulnerability-coldfusion.html

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment