Log4-detector 是一个可以在任何应用程序中的文件系统上检测易受攻击的 Log4J 版本（CVE-2021-44228、CVE-2021-45046 等）的扫描程序。

甚至能够找到隐藏在几层深处的 Log4J 实例。适用于 Linux、Windows 和 Mac，也适用于 Java 运行的其他任何地方。

用法

java -jar log4j-detector-2021.12.22.jar 

Usage: java -jar log4j-detector-2021.12.22.jar [--verbose] [--json] [--stdin] [--exclude=X] [paths to scan...]

  --json       - Output STDOUT results in JSON.  (Errors/warning still emitted to STDERR)
  --stdin      - Read STDIN for paths to explore (one path per line)
  --exclude=X  - Where X is a JSON list containing full paths to exclude. Must be valid JSON.

                 Example: --exclude='["/dev", "/media", "Z:\TEMP"]'

Exit codes:  0 = No vulnerable Log4J versions found.
             1 = At least one legacy Log4J 1.x version found.
             2 = At least one vulnerable Log4J version found.

About - MergeBase log4j detector (version 2021.12.22)
Docs  - https://github.com/mergebase/log4j-detector 
(C) Copyright 2021 Mergebase Software Inc. Licensed to you via GPLv3.

示例

java -jar log4j-detector-2021.12.22.jar [path-to-scan] > hits.txt

更多示例

java -jar log4j-detector-2021.12.22.jar ./samples 

-- github.com/mergebase/log4j-detector v2021.12.22 (by mergebase.com) analyzing paths (could take a while).
-- Note: specify the '--verbose' flag to have every file examined printed to STDERR.
/opt/mergebase/log4j-detector/samples/clt-1.0-SNAPSHOT.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/infinispan-embedded-query-8.2.12.Final.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-1.1.3.jar contains Log4J-1.x   <= 1.2.17 _OLD_
/opt/mergebase/log4j-detector/samples/log4j-1.2.13.jar contains Log4J-1.x   <= 1.2.17 _OLD_
/opt/mergebase/log4j-detector/samples/log4j-1.2.17.jar contains Log4J-1.x   <= 1.2.17 _OLD_
/opt/mergebase/log4j-detector/samples/log4j-core-2.0-beta2.jar contains Log4J-2.x   <= 2.0-beta8 _POTENTIALLY_SAFE_ (or did you already remove JndiLookup.class?) 
/opt/mergebase/log4j-detector/samples/log4j-core-2.0-beta9.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.0.2.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.0.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.10.0.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.12.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.12.2.jar contains Log4J-2.x   == 2.12.2 _OKAY_
/opt/mergebase/log4j-detector/samples/log4j-core-2.12.3.jar contains Log4J-2.x   >= 2.12.3 _SAFE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.14.1.jar contains Log4J-2.x   >= 2.10.0 _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.15.0.jar contains Log4J-2.x   == 2.15.0 _OKAY_
/opt/mergebase/log4j-detector/samples/log4j-core-2.16.0.jar contains Log4J-2.x   == 2.16.0 _OKAY_
/opt/mergebase/log4j-detector/samples/log4j-core-2.17.0.jar contains Log4J-2.x   >= 2.17.0 _SAFE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.3.1.jar contains Log4J-2.x   == 2.3.1 _SAFE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.4.1.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_
/opt/mergebase/log4j-detector/samples/log4j-core-2.9.1.jar contains Log4J-2.x   >= 2.0-beta9 (< 2.10.0) _VULNERABLE_

扫描结果

Log4-detector 会将 log4j-core 版本 2.3.1、2.12.3 和 2.17.0 报告为 _SAFE_ ，将2.12.2、2.15.0和 2.16.0 报告为_OKAY_，将所有其他版本 报告为 _VULNERABLE_，将旧的log4j-1.x版本报告为 _OLD_。

可以正确检测可执行 spring-boot jars/wars 中的 log4j、混合到 uber jars 中的依赖项、shaded jars，甚至是未压缩的jar 文件(又名*.class)。

• _VULNERABLE_ -> 需要升级或删除此文件。
• _OKAY_ -> 仅针对 Log4J 版本 2.12.2、2.15.0 和 2.16.0 报告此问题，建议升级到 2.17.0。
• _SAFE_ -> 目前仅针对 Log4J 版本 2.3.1、2.12.3 和 2.17.0（及更高版本）报告此问题。
• _OLD_ -> 可以免受 CVE-2021-44228 的影响，但应该计划升级，因为 Log4J 1.2.x 已经停产 7 年并且有几个已知的漏洞。
• _POTENTIALLY_SAFE_ -> “JndiLookup.class”文件不存在，要么是因为您的 Log4J 版本很旧（2.0-beta9 之前），要么因为有人已经删除了这个文件。如果是这种情况，请确保是团队或公司的成员删除“JndiLookup.class”，因为攻击者会自己删除此文件，以防止其他竞争攻击者获得对受感染系统的访问权限。