Skip to content

Commit ff8d83a

Browse files
author
Johannes Spaeth
committed
no message
1 parent 39a82a5 commit ff8d83a

File tree

10 files changed

+25
-32
lines changed

10 files changed

+25
-32
lines changed

‎README.md‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
1+
![alt text](logo.png | width=150)
2+
13
# Log4JShell Bytecode Detector
24

35
This repository contains a tool to detect if a jar file is affected by the critical CVE-2021-44228. The tool scans the jar file and compares the classses against a set of vulnerable hashes for classes within the jar file. The hashes have been pre-computed for artifacts on [Maven Central](https://mvnrepository.com/repos/central).
46

57
## How to run this tool
68

79
1. Download the jar file under releases. TODO add link.
8-
2. Run `java -cp <PATH_TO_DOWNLOADED_JAR> de.codeshield.log4jcheck.Log4JDetector <PATH_TO_`
10+
2. Run `java -cp <PATH_TO_DOWNLOADED_JAR> de.codeshield.log4jshell.Log4JDetector <PATH_TO_`
911

1012

1113
If the jar is affected, the tool outputs information to the command-line:
@@ -73,9 +75,12 @@ As affected version range we considered [2.0-beta9, 2.14) [Reference](https://lo
7375
## Fingerprinting Technology
7476
This tool uses a new bytecode fingerprinting technology for Java that has been invented by Andreas Dann. The basic flow is as follows.
7577
1. Use the available fix commits [Commit1](https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=7fe72d6), [Commit2](https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=d82b47c), and [Commit3](https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=c77b3cb) to identify which classes are affected.
76-
2. Compute bytecode hashes using the Fingerprinting technologites of the vulnerable classes.
77-
3. Search for other classes on MavenCentral whose fingerprint match.
78+
2. Compute bytecode "Fingerprints" of vulnerable classes.
79+
3. Search for other classes on MavenCentral with same "Fingerprint".
7880

7981
Details on the technology are found in the paper [SootDiff](https://dl.acm.org/doi/10.1145/3315568.3329966).
8082

8183
*Note: This repository does only ship SHA hashes of the vulnerable classes and does not compute the Fingerprint on your jar*
84+
85+
## If you want to learn more about the technology, reach out to us!
86+
https://codeshield.io/

‎logo.png‎

420 KB
Loading

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
<configuration>
6565
<archive>
6666
<manifest>
67-
<mainClass>de.codeshield.log4jcheck.Log4JDetector</mainClass>
67+
<mainClass>de.codeshield.log4jshell.Log4JDetector</mainClass>
6868
</manifest>
6969
</archive>
7070
<descriptorRefs>

src/main/java/de/codeshield/log4jcheck/ClassDetector.java renamed to src/main/java/de/codeshield/log4jshell/ClassDetector.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
package de.codeshield.log4jcheck;
1+
package de.codeshield.log4jshell;
22

3-
import de.codeshield.log4jcheck.data.VulnerableClassSHAData;
3+
import de.codeshield.log4jshell.data.VulnerableClassSHAData;
44
import java.io.IOException;
55
import java.io.InputStream;
66
import java.util.Set;

src/main/java/de/codeshield/log4jcheck/Log4JDetector.java renamed to src/main/java/de/codeshield/log4jshell/Log4JDetector.java

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,7 @@
1-
package de.codeshield.log4jcheck;
1+
package de.codeshield.log4jshell;
22

33
import java.io.File;
44
import java.io.IOException;
5-
import java.nio.file.Files;
6-
import java.nio.file.Path;
7-
import java.nio.file.Paths;
85
import java.util.Enumeration;
96
import java.util.jar.JarEntry;
107
import java.util.jar.JarFile;

src/main/java/de/codeshield/log4jcheck/POMDetector.java renamed to src/main/java/de/codeshield/log4jshell/POMDetector.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
package de.codeshield.log4jcheck;
1+
package de.codeshield.log4jshell;
22

3-
import de.codeshield.log4jcheck.data.GAVWithClassifier;
4-
import de.codeshield.log4jcheck.data.VulnerableGavsData;
3+
import de.codeshield.log4jshell.data.GAVWithClassifier;
4+
import de.codeshield.log4jshell.data.VulnerableGavsData;
55
import java.io.IOException;
66
import java.io.InputStream;
77
import java.util.List;

src/main/java/de/codeshield/log4jcheck/data/GAVWithClassifier.java renamed to src/main/java/de/codeshield/log4jshell/data/GAVWithClassifier.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package de.codeshield.log4jcheck.data;
1+
package de.codeshield.log4jshell.data;
22

33
import java.util.Objects;
44

src/main/java/de/codeshield/log4jcheck/data/VulnerableClassSHAData.java renamed to src/main/java/de/codeshield/log4jshell/data/VulnerableClassSHAData.java

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,11 @@
1-
package de.codeshield.log4jcheck.data;
1+
package de.codeshield.log4jshell.data;
22

33
import com.opencsv.CSVReader;
44
import com.opencsv.exceptions.CsvException;
55
import java.io.BufferedReader;
66
import java.io.IOException;
77
import java.io.InputStream;
88
import java.io.InputStreamReader;
9-
import java.net.URISyntaxException;
10-
import java.net.URL;
11-
import java.nio.file.Files;
12-
import java.nio.file.Paths;
139
import java.util.HashSet;
1410
import java.util.Set;
1511

src/main/java/de/codeshield/log4jcheck/data/VulnerableGavsData.java renamed to src/main/java/de/codeshield/log4jshell/data/VulnerableGavsData.java

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,11 @@
1-
package de.codeshield.log4jcheck.data;
1+
package de.codeshield.log4jshell.data;
22

33
import com.opencsv.CSVReader;
44
import com.opencsv.exceptions.CsvException;
55
import java.io.BufferedReader;
66
import java.io.IOException;
77
import java.io.InputStream;
88
import java.io.InputStreamReader;
9-
import java.net.URISyntaxException;
10-
import java.net.URL;
11-
import java.nio.file.Files;
12-
import java.nio.file.Paths;
139
import java.util.HashSet;
1410
import java.util.Set;
1511

src/test/java/de/codeshield/Log4JDetectorTests.java renamed to src/test/java/de/codeshield/log4jshell/Log4JDetectorTests.java

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,30 @@
1-
package de.codeshield;
1+
package de.codeshield.log4jshell;
22

33
import static org.junit.Assert.assertFalse;
44
import static org.junit.Assert.assertTrue;
55

6-
import de.codeshield.log4jcheck.Log4JDetector;
6+
import java.io.File;
77
import java.io.IOException;
8+
import java.net.URISyntaxException;
89
import java.net.URL;
9-
import java.nio.file.Paths;
1010
import org.junit.Test;
1111

1212
public class Log4JDetectorTests
1313
{
1414
@Test
15-
public void checkVulnerables() throws IOException {
15+
public void checkVulnerables() throws IOException, URISyntaxException {
1616
assertTrue(checkResourceFile("/en16931-xml-validator-2.0.0-b2-jar-with-dependencies.jar"));
1717
}
1818

1919
@Test
20-
public void checkSecure() throws IOException{
20+
public void checkSecure() throws IOException, URISyntaxException {
2121
assertFalse(checkResourceFile("/spring-boot-2.5.7.jar") );
2222
}
2323

24-
25-
private boolean checkResourceFile(String url) throws IOException {
24+
private boolean checkResourceFile(String url) throws IOException, URISyntaxException {
2625
URL resource = Log4JDetectorTests.class.getResource(url);
2726

2827
Log4JDetector detector = new Log4JDetector();
29-
return detector.run(Paths.get(resource.getPath()));
28+
return detector.run(new File(resource.toURI()));
3029
}
3130
}

0 commit comments

Comments
 (0)