How to Detect CVE-2021-44228 Log4Shell Vulnerability in Your Server?

Log4Shell vulnerability is considered the most significant vulnerability of the year because of its ease of exploitability with a CVSS score of 10.0. The vulnerability allows attackers to carry out the unauthenticated, remote code execution on any application it uses the Log4j library. The worst is Log4j library is part of a wide range of applications. This made the millions of machines vulnerable to the CVE-2021-44228 Log4Shell Vulnerability. We have seen the summary of the CVE-2021-44228 Log4Shell Vulnerability with permanent fix and mitigation actions in our previous post. However, before you fix CVE-2021-44228 Log4Shell Vulnerability, it is important to detect the vulnerable machines on your network. Let’s see how to detect CVE-2021-44228 Log4Shell Vulnerability in your server.

We have created this post to let all of you know how to detect the CVE-2021-44228 Log4Shell Vulnerability on your network. Let’s get started.

The vulnerability affects anybody who’s using the log4j packages log4j-core, log4j-api. You may need to check the version as different versions will have different mitigation advisories.

If you are searching for a command to check the Log4j version, then you may end up with no results. There is no such command that will tell you the version of Log4j installed on your system. Some applications ship the libraries directly as a jar file and some will contain them in archives. You may need to prep inside the jar or archive to see the version of Log4j.

1. Search For Files On The File System

Searching the file by name ‘Log4j’ in the file system is the simplest way to detect CVE-2021-44228 Log4Shell Vulnerability. This is a less accurate method of detection. However it is the most convenient and easiest way.

# find / -name log4j*

2. Scan The Package

There is a command line utility to check .jar and .war files and report if anything looks vulnerable. The tool matches the hashes of known vulnerable Log4j classes with the Log4j classes found on the server. The auto scan tool is available for download here. Please make sure that you download the correct version for your operating system.

Step 1. Download the Log4j scanning tool using the wget command

# wget https://github.com/lunasec-io/lunasec/releases/download/v1.0.0-log4shell/lunasec_1.0.0-log4shell_Linux_x86_64.tar.gz

Step 2. Extract the downloaded log4shell tool

# tar -xzf lunasec_1.0.0-log4shell_Linux_x86_64.tar.gz

Step 3. Scan the system using the log4shell tool

After extracting the log4shell tool, run the tool using “./log4shell  scan” commend.command syntax: ./log4shell scan <directory or jar file>

Linux:
# ./log4shell scan /opt/splunk/


Windows:
> log4shell.exe scan /opt/splunk/

3. Scan for Vulnerable JAR files Using LunaSec

LunaSec is an end-to-end security system designed to protect your application by transparently encrypting sensitive data, from browser to database. It works seamlessly by storing your sensitive data and then giving you back a Token (a UUID) to retrieve data with later. LunaSec builds on that concept to offer many security and compliance features. Click here and ask for the demo.

LunaSec can also be used to check the vulnerable JAR files. However, this method may not effective in as much as previous two.

Step 1. Download the LunaSec app from the Git page.

# git clone https://github.com/lunasec-io/lunasec.git

Step 2. Change the directory to lunasec/tools/log4shell-jar-scripts

# cd lunasec/tools/log4shell-jar-scripts

Step 3. Run the setup.sh

# ./setup.sh

Step 4. Search for Vulnerable JAR Files

# ./find-bad-deps.sh /path/to/folder/to/scan

IoCs of CVE-2021-44228 Log4Shell Vulnerability:

We hope this post would help you learning how to detect CVE-2021-44228 Log4Shell vulnerability on your machines. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.

You may also like these articles: