Anti Log4Shell Nginx Configuration

Anti Log4Shell Nginx Configuration

# Based Upon

This is a dumbed down version of the below provided code which seems to be overly complex to me.

https://www.infiniroot.com/blog/1155/using-nginx-lua-script-mitigate-log4shell-cve-2021-44228-vulnerability

anti_log4shell.conf

lua_need_request_body on;

# simplified LUA block to detect, block and log Log4Shell attacks
rewrite_by_lua_block {
  local h, err = ngx.req.get_headers()
  if err then
    ngx.log(ngx.ERR, "error: ", err)
    return
  end
  for k, v in pairs(h) do
    if v then
      s = tostring(v)
      if string.match(string.lower(s), "${") then
        ngx.log(ngx.ERR, 'Found potential log4j attack in header ' .. k .. ':' .. tostring(v))
        ngx.exit(ngx.HTTP_FORBIDDEN)
      end
    end
  end
}

Server Conf Integration

server {
...
        include anti_log4shell.conf;
...
}