Skip to content

Commit 0541699

Browse files
author
Johannes Spaeth
committed
Initial commit
1 parent 1d95796 commit 0541699

13 files changed

Lines changed: 568 additions & 0 deletions

‎.gitignore‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
2+
# Created by https://www.toptal.com/developers/gitignore/api/intellij,maven
3+
# Edit at https://www.toptal.com/developers/gitignore?templates=intellij,maven
4+
5+
### Intellij ###
6+
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
7+
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
8+
9+
# User-specific stuff
10+
.idea/**/workspace.xml
11+
.idea/**/tasks.xml
12+
.idea/**/usage.statistics.xml
13+
.idea/**/dictionaries
14+
.idea/**/shelf
15+
16+
# AWS User-specific
17+
.idea/**/aws.xml
18+
19+
# Generated files
20+
.idea/**/contentModel.xml
21+
22+
# Sensitive or high-churn files
23+
.idea/**/dataSources/
24+
.idea/**/dataSources.ids
25+
.idea/**/dataSources.local.xml
26+
.idea/**/sqlDataSources.xml
27+
.idea/**/dynamic.xml
28+
.idea/**/uiDesigner.xml
29+
.idea/**/dbnavigator.xml
30+
31+
# Gradle
32+
.idea/**/gradle.xml
33+
.idea/**/libraries
34+
35+
# Gradle and Maven with auto-import
36+
# When using Gradle or Maven with auto-import, you should exclude module files,
37+
# since they will be recreated, and may cause churn. Uncomment if using
38+
# auto-import.
39+
# .idea/artifacts
40+
# .idea/compiler.xml
41+
# .idea/jarRepositories.xml
42+
# .idea/modules.xml
43+
# .idea/*.iml
44+
# .idea/modules
45+
# *.iml
46+
# *.ipr
47+
48+
# CMake
49+
cmake-build-*/
50+
51+
# Mongo Explorer plugin
52+
.idea/**/mongoSettings.xml
53+
54+
# File-based project format
55+
*.iws
56+
57+
# IntelliJ
58+
out/
59+
60+
# mpeltonen/sbt-idea plugin
61+
.idea_modules/
62+
63+
# JIRA plugin
64+
atlassian-ide-plugin.xml
65+
66+
# Cursive Clojure plugin
67+
.idea/replstate.xml
68+
69+
# Crashlytics plugin (for Android Studio and IntelliJ)
70+
com_crashlytics_export_strings.xml
71+
crashlytics.properties
72+
crashlytics-build.properties
73+
fabric.properties
74+
75+
# Editor-based Rest Client
76+
.idea/httpRequests
77+
78+
# Android studio 3.1+ serialized cache file
79+
.idea/caches/build_file_checksums.ser
80+
81+
### Intellij Patch ###
82+
# Comment Reason: https://github.com/joeblau/gitignore.io/issues/186#issuecomment-215987721
83+
84+
# *.iml
85+
# modules.xml
86+
# .idea/misc.xml
87+
# *.ipr
88+
89+
# Sonarlint plugin
90+
# https://plugins.jetbrains.com/plugin/7973-sonarlint
91+
.idea/**/sonarlint/
92+
93+
# SonarQube Plugin
94+
# https://plugins.jetbrains.com/plugin/7238-sonarqube-community-plugin
95+
.idea/**/sonarIssues.xml
96+
97+
# Markdown Navigator plugin
98+
# https://plugins.jetbrains.com/plugin/7896-markdown-navigator-enhanced
99+
.idea/**/markdown-navigator.xml
100+
.idea/**/markdown-navigator-enh.xml
101+
.idea/**/markdown-navigator/
102+
103+
# Cache file creation bug
104+
# See https://youtrack.jetbrains.com/issue/JBR-2257
105+
.idea/$CACHE_FILE$
106+
107+
# CodeStream plugin
108+
# https://plugins.jetbrains.com/plugin/12206-codestream
109+
.idea/codestream.xml
110+
111+
### Maven ###
112+
target/
113+
pom.xml.tag
114+
pom.xml.releaseBackup
115+
pom.xml.versionsBackup
116+
pom.xml.next
117+
release.properties
118+
dependency-reduced-pom.xml
119+
buildNumber.properties
120+
.mvn/timing.properties
121+
# https://github.com/takari/maven-wrapper#usage-without-binary-jar
122+
.mvn/wrapper/maven-wrapper.jar
123+
124+
### Maven Patch ###
125+
# Eclipse m2e generated files
126+
# Eclipse Core
127+
.project
128+
# JDT-specific (Eclipse Java Development Tools)
129+
.classpath
130+
131+
# End of https://www.toptal.com/developers/gitignore/api/intellij,maven

‎pom.xml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<project xmlns="http://maven.apache.org/POM/4.0.0"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
6+
<modelVersion>4.0.0</modelVersion>
7+
8+
<groupId>de.codeshield</groupId>
9+
<artifactId>cve-2021-44228-detector</artifactId>
10+
<version>0.0.1-SNAPSHOT</version>
11+
12+
<name>cve-2021-44228-detector</name>
13+
<url>http://www.codeshield.io</url>
14+
15+
<properties>
16+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
17+
<maven.compiler.source>1.7</maven.compiler.source>
18+
<maven.compiler.target>1.7</maven.compiler.target>
19+
</properties>
20+
21+
<dependencies>
22+
<dependency>
23+
<groupId>junit</groupId>
24+
<artifactId>junit</artifactId>
25+
<version>4.11</version>
26+
<scope>test</scope>
27+
</dependency>
28+
<dependency>
29+
<groupId>org.apache.maven</groupId>
30+
<artifactId>maven-model</artifactId>
31+
<version>3.8.4</version>
32+
</dependency>
33+
34+
<!-- https://mvnrepository.com/artifact/org.apache.maven/maven-project -->
35+
<dependency>
36+
<groupId>org.apache.maven</groupId>
37+
<artifactId>maven-project</artifactId>
38+
<version>2.2.1</version>
39+
</dependency>
40+
<!-- https://mvnrepository.com/artifact/commons-codec/commons-codec -->
41+
<dependency>
42+
<groupId>commons-codec</groupId>
43+
<artifactId>commons-codec</artifactId>
44+
<version>1.15</version>
45+
</dependency>
46+
47+
<dependency>
48+
<groupId>com.opencsv</groupId>
49+
<artifactId>opencsv</artifactId>
50+
<version>5.5.2</version>
51+
</dependency>
52+
<dependency>
53+
<groupId>junit</groupId>
54+
<artifactId>junit</artifactId>
55+
<version>4.12</version>
56+
<scope>test</scope>
57+
</dependency>
58+
</dependencies>
59+
60+
<build>
61+
<plugins>
62+
<plugin>
63+
<artifactId>maven-assembly-plugin</artifactId>
64+
<configuration>
65+
<archive>
66+
<manifest>
67+
<mainClass>de.codeshield.log4jcheck.Log4JDetector</mainClass>
68+
</manifest>
69+
</archive>
70+
<descriptorRefs>
71+
<descriptorRef>jar-with-dependencies</descriptorRef>
72+
</descriptorRefs>
73+
</configuration>
74+
</plugin>
75+
<plugin>
76+
<groupId>org.apache.maven.plugins</groupId>
77+
<artifactId>maven-compiler-plugin</artifactId>
78+
<configuration>
79+
<source>8</source>
80+
<target>8</target>
81+
</configuration>
82+
</plugin>
83+
</plugins>
84+
<pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
85+
<plugins>
86+
<!-- clean lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#clean_Lifecycle -->
87+
<plugin>
88+
<artifactId>maven-clean-plugin</artifactId>
89+
<version>3.1.0</version>
90+
</plugin>
91+
<!-- default lifecycle, jar packaging: see https://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_jar_packaging -->
92+
<plugin>
93+
<artifactId>maven-resources-plugin</artifactId>
94+
<version>3.0.2</version>
95+
</plugin>
96+
<plugin>
97+
<artifactId>maven-compiler-plugin</artifactId>
98+
<version>3.8.0</version>
99+
</plugin>
100+
<plugin>
101+
<artifactId>maven-surefire-plugin</artifactId>
102+
<version>2.22.1</version>
103+
</plugin>
104+
<plugin>
105+
<artifactId>maven-jar-plugin</artifactId>
106+
<version>3.0.2</version>
107+
</plugin>
108+
<plugin>
109+
<artifactId>maven-install-plugin</artifactId>
110+
<version>2.5.2</version>
111+
</plugin>
112+
<plugin>
113+
<artifactId>maven-deploy-plugin</artifactId>
114+
<version>2.8.2</version>
115+
</plugin>
116+
<!-- site lifecycle, see https://maven.apache.org/ref/current/maven-core/lifecycles.html#site_Lifecycle -->
117+
<plugin>
118+
<artifactId>maven-site-plugin</artifactId>
119+
<version>3.7.1</version>
120+
</plugin>
121+
<plugin>
122+
<artifactId>maven-project-info-reports-plugin</artifactId>
123+
<version>3.0.0</version>
124+
</plugin>
125+
</plugins>
126+
</pluginManagement>
127+
</build>
128+
</project>

‎src/main/java/de/codeshield/log4jcheck/ClassDetector.java‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
package de.codeshield.log4jcheck;
2+
3+
import de.codeshield.log4jcheck.data.VulnerableClassSHAData;
4+
import java.io.IOException;
5+
import java.io.InputStream;
6+
import java.util.Set;
7+
import org.apache.commons.codec.digest.DigestUtils;
8+
9+
public class ClassDetector {
10+
11+
private static Set<String> VULNERABLE_CLASS_SHAS = VulnerableClassSHAData.readDataFromCSV();
12+
13+
public static boolean isVulnerableClass(InputStream inputStream) {
14+
return VULNERABLE_CLASS_SHAS.contains(getSha256DigestFor(inputStream));
15+
}
16+
17+
private static String getSha256DigestFor(InputStream key) {
18+
String digest = null;
19+
try {
20+
digest = new DigestUtils(DigestUtils.getSha256Digest()).digestAsHex(key);
21+
} catch (IOException e) {
22+
System.out.println("Unable to compute SHA for class. Continuing analysis.");
23+
}
24+
return digest;
25+
}
26+
}

‎src/main/java/de/codeshield/log4jcheck/Log4JDetector.java‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
package de.codeshield.log4jcheck;
2+
3+
import java.io.File;
4+
import java.io.IOException;
5+
import java.nio.file.Files;
6+
import java.nio.file.Path;
7+
import java.nio.file.Paths;
8+
import java.util.Enumeration;
9+
import java.util.jar.JarEntry;
10+
import java.util.jar.JarFile;
11+
12+
/**
13+
* A simple command line tool that scans a jar file for the CVE-2021-44228 vulnerability that
14+
* concerns log4j.
15+
*/
16+
public class Log4JDetector {
17+
18+
private static final String POM_FILE = "pom.xml";
19+
private static final String CLASS_FILE_NAME = ".class";
20+
21+
public static void main(String[] args) {
22+
System.out.println("Analysing "+ args[0]);
23+
File inputJarFile = new File(args[0]);
24+
if (!inputJarFile.exists()) {
25+
System.err.println("The file path " + args[0] + " does not exist. Ensure it is an absolute file paths");
26+
return;
27+
}
28+
Log4JDetector detector = new Log4JDetector();
29+
detector.run(inputJarFile);
30+
}
31+
32+
public boolean run(File pathToJarFile) {
33+
JarFile jarFile = null;
34+
boolean isVulnerable = false;
35+
try {
36+
jarFile = new JarFile(pathToJarFile);
37+
Enumeration<JarEntry> entries = jarFile.entries();
38+
while (entries.hasMoreElements()) {
39+
JarEntry entry = entries.nextElement();
40+
//Check pom.xml files if a log4j dependency is declared
41+
if (entry.getName().endsWith(Log4JDetector.POM_FILE)) {
42+
if (POMDetector.isVulnerablePOM(jarFile.getInputStream(entry))) {
43+
isVulnerable = true;
44+
System.err.println("CVE-2021-44228 found declared as dependency in " + entry);
45+
}
46+
}
47+
//Check if a a class file matches one of the pre-computed vulnerable SHAs.
48+
if (entry.getName().endsWith(Log4JDetector.CLASS_FILE_NAME)) {
49+
if (ClassDetector.isVulnerableClass(jarFile.getInputStream(entry))) {
50+
isVulnerable = true;
51+
System.err.println("CVE-2021-44228 found in class file " + entry);
52+
}
53+
}
54+
}
55+
} catch (IOException e) {
56+
System.err.println("Unable to open JarFile");
57+
}
58+
if(!isVulnerable){
59+
System.out.println("Jar file not affected by CVE-2021-44228!");
60+
}
61+
return isVulnerable;
62+
}
63+
64+
65+
}

0 commit comments

Comments
 (0)