CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Description

Rapidly scan filesystems for Java programs potentially vulnerable to Log4Shell (CVE-2021-44228) or "that Log4j JNDI exploit" by inspecting the class paths inside files

Readme

# log4shelldetect

Scans a file or folder recursively for Java programs that may be vulnerable to:

- CVE-2021-44228 (Log4Shell) (v2.0.x - v2.14.x)
- CVE-2021-45046 (v2.15.x)
- CVE-2021-45105 (v2.16.x)[^*]

[^*]: 2.12.2 detection is not available yet pending 2.12.3's release which I will need to test. 2.12.2 will appear as patched.

by inspecting the class paths inside files.

If you only want possibly vulnerable files to be printed rather than all files, run with `-mode list`.

![Demo of log4shelldetect](./demo.png)

## Usage

```
Usage: log4shelldetect [options] <path>

Options:
  -include-zip
        include zip files in the scan
  -mode string
        the output mode, either "report" (every java archive pretty printed) or "list" (list of potentially vulnerable files) (default "report")
```

## License

Code here is released to the public domain under [unlicense](/LICENSE).

With the exception of `velocity-1.1.9.jar` which is an example vulnerable `.jar` file part of [Velocity](https://github.com/PaperMC/Velocity) which is licensed under GPLv3.

File Snapshot

 [4.0K]  /data/pocs/d4706dbc4ad952cc77558bea5925ad66cf3f3389
├── [ 39K]  demo.png
├── [ 308]  go.mod
├── [1.2K]  go.sum
├── [1.2K]  LICENSE
├── [ 10K]  main.go
├── [1.0K]  README.md
└── [ 13M]  velocity-1.1.9.jar

0 directories, 7 files

Remarks