{"id":13842065,"url":"https://github.com/palantir/log4j-sniffer","last_synced_at":"2025-04-04T17:07:16.228Z","repository":{"id":37240462,"uuid":"439431339","full_name":"palantir/log4j-sniffer","owner":"palantir","description":"A tool that scans archives to check for vulnerable log4j versions","archived":false,"fork":false,"pushed_at":"2025-03-27T12:24:50.000Z","size":49802,"stargazers_count":195,"open_issues_count":3,"forks_count":23,"subscribers_count":232,"default_branch":"develop","last_synced_at":"2025-03-28T16:06:19.279Z","etag":null,"topics":["cve-2021-44228","log4j","log4j2","octo-correct-managed"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/palantir.png","metadata":{"files":{"readme":"README.md","changelog":"changelog/0.3.0/pr-6.v2.yml","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-12-17T18:50:43.000Z","updated_at":"2025-03-27T12:24:53.000Z","dependencies_parsed_at":"2024-01-14T08:45:50.863Z","dependency_job_id":"1b19e84b-5a52-45ee-b7c0-2d2881ca5a4e","html_url":"https://github.com/palantir/log4j-sniffer","commit_stats":null,"previous_names":[],"tags_count":18,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/palantir%2Flog4j-sniffer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/palantir%2Flog4j-sniffer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/palantir%2Flog4j-sniffer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/palantir%2Flog4j-sniffer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/palantir","download_url":"https://codeload.github.com/palantir/log4j-sniffer/tar.gz/refs/heads/develop","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247217177,"owners_count":20903009,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2021-44228","log4j","log4j2","octo-correct-managed"],"created_at":"2024-08-04T17:01:26.772Z","updated_at":"2025-04-04T17:07:16.202Z","avatar_url":"https://github.com/palantir.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"\u003cp align=\"right\"\u003e\n\u003ca href=\"https://autorelease.general.dmz.palantir.tech/palantir/log4j-sniffer\"\u003e\u003cimg src=\"https://img.shields.io/badge/Perform%20an-Autorelease-success.svg\" alt=\"Autorelease\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\nlog4j-sniffer\n============\n\nlog4j-sniffer crawls for all instances of log4j on disk within a specified directory.\nIt can be used to determine whether there are any vulnerable instances of log4j within a directory tree and report or delete them depending on the mode used.\n\nScanning for versions affected by CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 and CVE-2021-44832 is currently supported.\n\nWhat this does\n==============\n\nlog4j-sniffer will scan a filesystem looking for all files of the following types based upon suffix:\n- Zips: .zip\n- Java archives: .jar, .war, .ear\n- Tar: .tar, .tar.gz, .tgz, .tar.bz2, .tbz2\n\nArchives containing other archives will be recursively inspected up to a configurable maximum depth.\nSee the `log4j-sniffer crawl --help` output for options on nested archive inspection.\n\nIt will look for the following:\n- Jar files matching `log4j-core-\u003cversion\u003e.jar`, including those nested within another archive\n- Class files named `org.apache.logging.log4j.core.net.JndiManager` within Jar files or other archives and check against md5 hashes of known versions\n- Class files named `JndiManager` in other package hierarchies and check against md5 hashes of known versions\n- Matching of the bytecode of classes named JndiManager against known classes (see below for more details)\n- Matching of bytecode within obfuscated or shaded jars for partial matches against known classes (see below)\n\nInstalling\n==========\nIf Go is available on the host system, the following command can be used to install this program:\n\n```\ngo install github.com/palantir/log4j-sniffer@latest\n```\n\nThis repository also publishes binaries that can be downloaded and executed.\n\nDownloads\n=========\n\nlog4j-sniffer executables compiled for linux-amd64, darwin-amd64, darwin-arm64 and windows-amd64 architectures are available on the [releases page](https://github.com/palantir/log4j-sniffer/releases).\n\nRunning\n=======\n\nThis tool is intensive and is recommended to be run with low priority settings.\n\nOn Linux:\n```\nionice -c 3 nice -n 19 log4j-sniffer crawl /path/to/a/directory\n```\n\nOutput for vulnerable files looks as follows:\n\n```\n[INFO] Found archive with name matching vulnerable log4j-core format at examples/single_bad_version/log4j-core-2.14.1.jar\n[INFO] Found JndiManager class that was an exact md5 match for a known version at org/apache/logging/log4j/core/net/JndiManager.class\n[INFO] Found JndiLookup class in the log4j package at org/apache/logging/log4j/core/lookup/JndiLookup.class\n[MATCH] CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-44832 detected in file examples/single_bad_version/log4j-core-2.14.1.jar. log4j versions: 2.14.0-2.14.1, 2.14.1. Reasons: JndiLookup class and package name matched, jar name matched, JndiManager class and package name matched, class file MD5 matched\nFiles affected by CVE-2021-44228 or CVE-2021-45046 or CVE-2021-45105 or CVE-2021-44832 detected: 1 file(s)\n1 total files scanned, skipped identifying 0 files due to config, skipped 0 paths due to permission denied errors, encountered 0 errors processing paths\n```\n\nGetting started\n===============\n\n### Mac\n\n##### Download the latest version\n\n1. Locate [releases](https://github.com/palantir/log4j-sniffer/releases).\n2. You will need a different asset depending on the generation of your Mac.\n    1. Select the asset with “macos-amd” in the file name for older Intel Macs.\n    2. Select “macos-arm” for newer m1 Macs\n3. Confirm that the file is downloading to your “Downloads” folder.\n\n##### Install log4j-sniffer on your machine\n\n1. Once the download is complete, click on the file to open.\n1. Drag and drop the “log4j-sniffer” icon into your Downloads through the Finder.\n    1. Open a Finder window by searching for “Finder” using the magnifying glass on the top right of your screen, or selecting the icon in your Dock.\n    2. Drag and drop the “log4j-sniffer” icon into Downloads.\n ![dragging and dropping](https://github.com/palantir/log4j-sniffer/blob/develop/mac_download.png?raw=true)\n\n##### Use log4j-sniffer\n\n1. Open the Terminal by searching for “Terminal” using the magnifying glass in the top right corner of the screen.\n2. Run `~/Downloads/log4j-sniffer crawl / --ignore-dir=\"^/dev\"` to crawl the entire system\n    1. Run `~/Downloads/log4j-sniffer crawl /PATH/TO/YOUR/FOLDER` to crawl specific folders\n    2. If your computer is unable to locate log4j-sniffer, you may have to make it executable before using it. In your terminal, run the following:\n        1. `chmod +x ~/Downloads/log4j-sniffer `\n        2. `./log4j-sniffer crawl /PATH/TO/YOUR/FOLDER`\n\n### Windows\n\n##### Download the latest version\n\n1. Locate [releases] (https://github.com/palantir/log4j-sniffer/releases).\n2. Select the Windows asset.\n3. Confirm that the file is downloading to your “Downloads” folder.\n\n##### Use log4j-sniffer\n\n1. Type \"Command Prompt\" into the search bar at the bottom and in the right pane click \"Run as administrator\".\n2. Navigate to your Downloads folder, e.g. `cd C:\\Users\\yourname\\Downloads`\n3. Run `log4j-sniffer-1.1.0-windows-amd64.exe crawl C:\\` to crawl the entire system, substituting the drive of your choice, e.g. `C:\\`, `D:\\`\n    1. Run `log4j-sniffer-1.1.0-windows-amd64.exe crawl C:\\PATH\\TO\\YOUR\\FOLDER` to crawl specific folders\n\nPrimary Usage\n=============\nThe primary command for the tool is `crawl` which takes an argument that is the path to the directory to be crawled.\nThus, the standard usage is:\n\n```\nlog4j-sniffer crawl [pathToDirectory]\n```\n\nThe standard mode prints output in a human-readable format and prints a summary that states the number of\nvulnerabilities found after running.\n\nSpecifying the `--json` flag makes it such that the output of the program is all in JSON: each line of output is JSON\nthat describes the vulnerability that is found, and if summary mode is enabled then the final summary is also output as\na line of JSON.\n\nHere is an example of the output with `--json`:\n\n```\n{\"message\":\"CVE-2021-44228, CVE-2021-44832, CVE-2021-45046, CVE-2021-45105 detected\",\"filePath\":\"examples/inside_a_dist/wrapped_log4j.tar.gz\",\"detailedPath\":\"examples/inside_a_dist/wrapped_log4j.tar.gz!log4j-core-2.14.1.jar\",\"cvesDetected\":[\"CVE-2021-44228\",\"CVE-2021-44832\",\"CVE-2021-45046\",\"CVE-2021-45105\"],\"findings\":[\"jndiLookupClassPackageAndName\",\"jarNameInsideArchive\",\"jndiManagerClassPackageAndName\",\"classFileMd5\"],\"log4jVersions\":[\"2.14.0-2.14.1\",\"2.14.1\"]}\n{\"filesScanned\":1,\"permissionDeniedErrors\":0,\"pathErrors\":0,\"pathsSkipped\":0,\"numImpactedFiles\":1}\n```\n\nThe JSON fields have the following meaning:\n- message: information about the output\n- filePath: the path to the file on disk where the vulnerability was detected\n- detailedPath: the path to the vulnerable contents, which may be an archived file multiple levels nested. Nesting levels are separated by a '!'\n- cvesDetected: CVEs matched against the version found\n- log4jVersions: the versions detected at this location based on all applied detections, note that some detections are more accurate than others and so a range of versions might be reported\n\nThe findings array reports the following possible values:\n- jndiLookupClassName: there was a .class file called `JndiLookup`\n- jndiLookupClassPackageAndName: there was a .class file called `JndiLookup` with a package of `org.apache.logging.log4j.core.lookup`\n- jndiManagerClassName: there was a .class file called `JndiManager`\n- jndiManagerClassPackageAndName: there was a .class file called `JndiManager` with a package of `org.apache.logging.log4j.core.net`\n- jarNameMatched: the file scanned was a .jar file called `log4j-core-\u003cversion\u003e.jar`\n- jarNameInsideArchiveMatched: there was a .jar file called `log4j-core-\u003cversion\u003e.jar` inside the archive\n- classFileMd5Matched: there was a class file called `JndiManager` that matched the md5 hash of a known version\n- classBytecodeInstructionMd5: the bytecode of a class file called `JndiManager` exactly matched a known version, see the [Bytecode matching](#bytecode-matching) section for more details\n- jarFileObfuscated: the jar the match was found in appeared to be obfuscated\n- classBytecodePartialMatch: the bytecode of a class file called `JndiManager`, or a class within an obfuscated jar, partially matched the bytecode of a known version, see the [Bytecode partial matching](#bytecode-partial-matching) section for more details\n\nThe summary outlines:\n- filesScanned: the total number of files crawled\n- permissionDeniedErrors: the number of directories or files that could not be read due to permissions\n- pathErrors: the number of paths where an unexpected error occurred while trying to identify bad log4j versions\n- pathsSkipped: the numbers of paths skipped from full identification of bad log4j versions due to the config options set\n- numImpactedFiles: the total number of files impacted\n- findings: the total number of findings previously output. For file path only mode, this will equal the number of impacted files.\n\nSpecifying `--summary=false` makes it such that the program does not output a summary line at the end. In this case,\nthe program will only print output if vulnerabilities are found.\n\nDetections quick match table\n============================\n\nThe following tables shows when each finding is reported based on our testing:\n\n|                                | Unmodified log4j-core-2.14.1.jar | JndiLookup removed log4j-core-2.14.1.jar | Inside a fat jar (no renaming) |\n|--------------------------------|----------------------------------|------------------------------------------|--------------------------------| \n| jndiLookupClassName            |                                  |                                          |                                |\n| jndiLookupClassPackageAndName  | :white_check_mark:               |                                          | :white_check_mark:             |\n| jndiManagerClassName           |                                  |                                          |                                |\n| jndiManagerClassPackageAndName | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:             |\n| jarNameMatched                 | :white_check_mark:               | :white_check_mark:                       |                                |\n| jarNameInsideArchiveMatched    |                                  |                                          |                                |\n| classFileMd5Matched            | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:             |\n| bytecodeInstructionMd5Matched  |                                  |                                          |                                |\n| jarFileObfuscated              |                                  |                                          |                                |\n| classBytecodePartialMatch      |                                  |                                          |                                |\n| **Detected**                   | :white_check_mark:               | :white_check_mark:                       | :white_check_mark:             |\n\n|                                | Shaded (packages renamed only) | Shaded (all renamed) | Shaded/obfuscated (bytecode optimised) |\n|--------------------------------|--------------------------------|----------------------|----------------------------------------|\n| jndiLookupClassName            | :white_check_mark:             |                      |                                        |\n| jndiLookupClassPackageAndName  |                                |                      |                                        |\n| jndiManagerClassName           | :white_check_mark:             |                      |                                        |\n| jndiManagerClassPackageAndName |                                |                      |                                        |\n| jarNameMatched                 |                                |                      |                                        |\n| jarNameInsideArchiveMatched    |                                |                      |                                        |\n| classFileMd5Matched            |                                |                      |                                        |\n| bytecodeInstructionMd5Matched  | :white_check_mark:             |                      |                                        |\n| jarFileObfuscated              |                                |                      | :white_check_mark:                     |\n| classBytecodePartialMatch      |                                | :white_check_mark:   | :white_check_mark:                     |\n| **Detected**                   | :white_check_mark:             | :white_check_mark:   | :white_check_mark:                     |\n\n\n|                                | log4j-core-2.14.1.jar inside a .tgz file  | Heavily obfuscated (additional bytecode instructions inserted) |\n|--------------------------------|-------------------------------------------|----------------------------------------------------------------|\n| jndiLookupClassName            |                                           |                                                                |\n| jndiLookupClassPackageAndName  | :white_check_mark:                        |                                                                |\n| jndiManagerClassName           |                                           |                                                                |\n| jndiManagerClassPackageAndName | :white_check_mark:                        |                                                                |\n| jarNameMatched                 |                                           |                                                                |\n| jarNameInsideArchiveMatched    | :white_check_mark:                        |                                                                |\n| classFileMd5Matched            | :white_check_mark:                        |                                                                |\n| bytecodeInstructionMd5Matched  |                                           |                                                                |\n| jarFileObfuscated              |                                           |                                                                |\n| classBytecodePartialMatch      |                                           |                                                                |\n| **Detected**                   | :white_check_mark:                        | :x:                                                            |\n\n\nSome of these detections may require non-default settings depending on the file scanned. Some detections may not identify all cases, common shading and obfuscation has been tested but it is not possible to cover every possible change that could be made by such a tool.\n\n\nBytecode matching\n=================\n\nIf a class is shaded (for example, to build a fat jar), then the bytecode is rewritten to update the package. This means the hash of the class will no longer match against known versions, nor will the class appear where expected within a jar.\n\nTo account for this, we perform a less accurate hash of a class file: we only hash the fixed parts of the bytecode defining each method, ignoring all parts that might vary upon shading. We take an md5 hash of the resulting bytecode and compare against known versions.\n\nTesting against shaded jars shows this matches when the package version has been changed but the class otherwise left intact. Shading which further modifies classes, such as by removing methods, will not be found with this approach.\n\nBytecode partial matching\n=========================\n\nIf the event of more aggressive shading, which deletes unused methods, or obfuscated being applied in order to compress the Jar size bytecode matching will not produce matches. The class of interest may also no longer be called `JndiManager` or appear under a package hierarchy that indicates the presence of log4j.\n\nFor these cases we have implemented partial bytecode matching based on signatures generated from obfuscated versions of the log4j jar compared against the version as shipped.\n\nBy default we apply this detection to classes called `JndiManager` which have not been matched by md5 or full bytecode matching, or to all classes in Jar files with an average package and class name length both under 3.\n\nA match here is likely but not guaranteed to be log4j within the reported version range. Obfuscation aimed to preventing reverse engineering rather than simply compressing the Jar size may also cause false negatives.\n\nTesting against know shaded jars in open source products, such as the Hive jdbc driver, has shown this approach to produce matches.\n\nCrawl command\n=============\n\n```\nCrawl filesystem to scan for jars vulnerable to CVE-2021-45046.\nRoot must be provided and can be a single file or directory.\nIf a directory is provided, it is traversed and all files are scanned.\nUse the ignore-dir flag to provide directories of which to ignore all nested files.\n\nUsage:\n  log4j-sniffer crawl \u003croot\u003e [flags]\n\nFlags:\n      --archive-open-mode string                             Supported values:\n                                                               standard - standard file opening will be used. This may cause the filesystem cache to be populated with reads from the archive opens.\n                                                               directio - direct I/O will be used when opening archives that require sequential reading of their content without being able to skip to file tables at known locations within the file.\n                                                                          For example, \"directio\" can have an effect on the way that tar-based archives are read but will have no effect on zip-based archives.\n                                                                          Using \"directio\" will cause the filesystem cache to be skipped where possible. \"directio\" is not supported on tmpfs filesystems and will cause tmpfs archive files to report an error. (default \"standard\")\n      --archives-per-second-rate-limit int                   The maximum number of archives to scan per second. 0 for unlimited.\n      --directories-per-second-rate-limit int                The maximum number of directories to crawl per second. 0 for unlimited.\n      --disable-cve-2021-44832-detection                     Disable detection of CVE-2021-44832 in versions up to 2.17.0\n      --disable-cve-2021-45105-detection                     Disable detection of CVE-2021-45105 in versions up to 2.16.0\n      --disable-detailed-findings                            Do not print out detailed finding information when not outputting in JSON.\n      --disable-flagging-jndi-lookup                         Do not report results that only match on the presence of a JndiLookup class.\n                                                             Even when disabled results which match other criteria will still report the presence of JndiLookup if relevant.\n      --disable-unknown-versions                             Only output issues if the version of log4j can be determined (note that this will cause certain detection mechanisms to be skipped)\n      --enable-obfuscation-detection                         Enable applying partial bytecode matching to Jars that appear to be obfuscated. (default true)\n      --enable-partial-matching-on-all-classes               Enable partial bytecode matching to all class files found.\n      --enable-trace-logging                                 Enables trace logging whilst crawling. disable-detailed-findings must be set to false (the default value) for this flag to have an effect.\n      --file-path-only                                       If true, output will consist of only paths to the files in which CVEs are detected\n  -h, --help                                                 help for crawl\n      --ignore-dir strings                                   Specify directory pattern to ignore. Use multiple times to supply multiple patterns.\n                                                             Patterns should be relative to the provided root.\n                                                             e.g. ignore \"^/proc\" to ignore \"/proc\" when using a crawl root of \"/\"\n      --json                                                 If true, output will be in JSON format\n      --maximum-average-obfuscated-class-name-length int     The maximum class name length for a class to be considered obfuscated. (default 3)\n      --maximum-average-obfuscated-package-name-length int   The maximum average package name length a class to be considered obfuscated. (default 3)\n      --nested-archive-disk-swap-dir string                  When nested-archive-disk-swap-max-size is non-zero, this is the directory in which temporary files will be created for writing temporary large nested archives to disk. (default \"/tmp\")\n      --nested-archive-disk-swap-max-size uint               The maximum size in bytes of disk space allowed to use for inspecting nest archives that are over the nested-archive-max-size.\n                                                             By default no disk swap is to be allowed, nested archives will only be inspected if they fit into the configured nested-archive-max-size.\n                                                             When an archive is encountered that is over the nested-archive-max-size, an the archive may be written out to a temporary file so that it can be inspected without a large memory penalty.\n                                                             If large archives are nested within each other, an archive will be opened only if the accumulated space used for archives on disk would not exceed the configured nested-archive-disk-swap-max-size.\n      --nested-archive-max-depth uint                        The maximum depth to recurse into nested archives.\n                                                             A max depth of 0 will open up an archive on the filesystem but not any nested archives.\n      --nested-archive-max-size uint                         The maximum compressed size in bytes of any nested archive that will be unarchived for inspection.\n                                                             This limit is made a per-depth level.\n                                                             The overall limit to nested archive size unarchived should be controlled\n                                                             by both the nested-archive-max-size and nested-archive-max-depth. (default 5242880)\n      --per-archive-timeout duration                         If this duration is exceeded when inspecting an archive,\n                                                             an error will be logged and the crawler will move onto the next file. (default 15m0s)\n      --summary                                              If true, outputs a summary of all operations once program completes (default true)\n```\n\n#### Archives\n\nArchives can both contain many files listed and have other archives nested within them. If either is followed without limit then it would be possible to cause scans to take either an unacceptable amount of time or consume an acceptable amount of memory.\n\n`--per-archive-timeout` allows for control of the maximum time a single archive will be examined.\n`--nested-archive-max-size` and `--nested-archive-max-depth` control how many nested archives are opened, and how large each one may be. The total memory required will be on the order to the product of these two values.\n\n####  Rate limiting\n\nWhile `nice` and `ionice` on Linux and other platform specific tooling can be used to limit the priority of processes it may be desired to further limit resource use. One example is when running on AWS instances with a burst balance for IO, which might be consumed by running this tool leading to a negative impact on other processes running on that instance.\n\n`--directories-per-second-rate-limit` and `--archives-per-second-rate-limit` limit how quickly directories will be traversed and how quickly archives will be processed.\n\n#### Obfuscation detection\n\nFor partial bytecode matching we apply a heuristic for whether a Jar is obfuscated. This is because the partial matching is expensive to apply and as such running it on every matching Jar on a system may not be feasible.\n\nThe heuristic used is that both the average package name length and class name length need to be below a certain value for a Jar to be considered obfuscated. By default this is 3. You can tune these values using `--maximum-average-obfuscated-class-name-length` and `--maximum-average-obfuscated-package-name-length`.\n\nIf you wish to turn off obfuscation detection entirely then `--enable-obfuscation-detection` can be used. If instead you wish to apply partial matching to all Jars, regardless of whether they appear obfuscated, then you can use `--enable-partial-matching-on-all-classes`.\n\n#### CVE-2021-45105 and CVE-2021-44832\n\nIf you do not wish to report results for CVE-2021-45105 or CVE-2021-44832 then pass the `--disable-cve-2021-45105-detection` or `--disable-cve-2021-44832-detection` flags to the crawl command.\n\nBy default, both CVE-2021-45046 and CVE-2021-45105 will be reported.\n\n### Examples\n\nRunning on Linux against the entire filesystem at a low priority:\n```\nionice -c 3 nice -n 19 log4j-sniffer crawl / --ignore-dir \"^/dev\" --ignore-dir \"^/proc\"\n```\n\nRunning against a specific Jar with all limits removed:\n```\nlog4j-sniffer crawl jar-under-suspicion.jar --enable-partial-matching-on-all-classes --nested-archive-max-depth 255 --nested-archive-max-size 5242880000\n```\n\nDelete command\n==============\n\nMost of the flags are shared with the crawl command and so it is recommended that delete be run using configuration that is known to not negatively impact performance of a host. \n\n```\nDelete files containing log4j vulnerabilities.\n\nCrawl the file system from root, detecting files containing log4j-vulnerabilities and deleting them if they meet certain requirements determined by the command flags.\nRoot must be provided and can be a single file or directory.\n\nDry-run mode is enabled by default, where a line will be output to state where a file would be deleted when running not in dry run mode.\nIt is recommended to run using dry-run mode enabled, checking the logged output and then running with dry-run disabled using the same configuration flags.\nUse --dry-run=false to turn off dry-run mode, enabling deletes.\n\nWhen used on windows, deleting based on file ownership is unsupported and skip-owner-check should be used instead of filepath-owner.\n\nUsage:\n  log4j-sniffer delete \u003croot\u003e [flags]\n\nExamples:\nDelete all findings nested beneath /path/to/dir that are owned by foo and contain findings that match both classFileMd5 and jarFileObfuscated.\n\nlog4j-sniffer delete /path/to/dir --dry-run=false --filepath-owner ^/path/to/dir/.*:foo --finding-match classFileMd5 --finding-match jarFileObfuscated\n\nFlags:\n      --archive-open-mode string                             Supported values:\n                                                               standard - standard file opening will be used. This may cause the filesystem cache to be populated with reads from the archive opens.\n                                                               directio - direct I/O will be used when opening archives that require sequential reading of their content without being able to skip to file tables at known locations within the file.\n                                                                          For example, \"directio\" can have an effect on the way that tar-based archives are read but will have no effect on zip-based archives.\n                                                                          Using \"directio\" will cause the filesystem cache to be skipped where possible. \"directio\" is not supported on tmpfs filesystems and will cause tmpfs archive files to report an error. (default \"standard\")\n      --archives-per-second-rate-limit int                   The maximum number of archives to scan per second. 0 for unlimited.\n      --directories-per-second-rate-limit int                The maximum number of directories to crawl per second. 0 for unlimited.\n      --disable-cve-2021-44832-detection                     Disable detection of CVE-2021-44832 in versions up to 2.17.0\n      --disable-cve-2021-45105-detection                     Disable detection of CVE-2021-45105 in versions up to 2.16.0\n      --dry-run                                              When true, a line with be output instead of deleting a file. Use --dry-run=false to enable deletion. (default true)\n      --enable-obfuscation-detection                         Enable applying partial bytecode matching to Jars that appear to be obfuscated. (default true)\n      --enable-partial-matching-on-all-classes               Enable partial bytecode matching to all class files found.\n      --enable-trace-logging                                 Enables trace logging whilst crawling. disable-detailed-findings must be set to false (the default value) for this flag to have an effect.\n      --filepath-owner strings                               Provide a filepath pattern and owner template that will be used to check whether a file should be deleted or not when it is deemed to be vulnerable.\n                                                             Multiple values can be provided and values must be provided in the form filepath_pattern:owner_template, where a filepath pattern and owner template are colon separated.\n\n                                                             When a file is deemed to be vulnerable, the path of the file containing the vulnerability will be matched against all filepath patterns.\n                                                             For all filepath matches, the owner template will be expanded against the filepath pattern match to resolve to a file owner value that the actual file owner will then be compared against.\n                                                             Owner templates may use template variables, e.g. $1, $2, $name, that correspond to capture groups in the filepath pattern. Please refer to the standard go regexp package documentation at https://pkg.go.dev/regexp#Regexp.Expand for more detailed expanding behaviour.\n\n                                                             If no filepaths match, the file will not be deleted. If any filepaths match, all matching filepath patterns' corresponding expanded templated owner values must match against the actual file owner for the file to be deleted.\n\n                                                             Architecture-specific behaviour:\n                                                             - linux-amd64: libc-backed code is used, which is able to infer the owner of a file over a broad range of account setups.\n                                                             - linux-arm64: only the user running or users from /etc/passwd will be available to infer file ownership.\n                                                             - darwin-*: only the user running or users from /etc/passwd will be available to infer file ownership.\n                                                             - windows-*: file ownership is unsupported and --skip-owner-check should be used instead.\n\n                                                             Examples:\n                                                             --filepath-owner ^/foo/bar/.+:qux would consider /foo/bar/baz for deletion only if it is owned by qux.\n                                                             --filepath-owner ^/foo/bar/.+:qux and --filepath-owner ^/foo/bar/baz/.+:quuz would not consider /foo/bar/baz/corge for deletion if owned by either qux or quuz because both would need to match.\n                                                             --filepath-owner ^/foo/(\\w+)/.*:$1 would consider /foo/bar/baz for deletion only if it is owned by bar.\n\n      --finding-match strings                                When supplied, any vulnerable finding must contain all values that are provided to finding-match for it to be considered for deletion.\n                                                             These values are considered on a finding-by-finding basis, i.e. an archive containing two separate vulnerable jars will only be deleted if either of the contained jars matches all finding-match values.\n\n                                                             Supported values are as follows, but can be provided case-insensitively:\n                                                             - ClassBytecodeInstructionMd5\n                                                             - ClassBytecodePartialMatch\n                                                             - ClassFileMd5\n                                                             - JarFileObfuscated\n                                                             - JarName\n                                                             - JarNameInsideArchive\n                                                             - JndiLookupClassName\n                                                             - JndiLookupClassPackageAndName\n                                                             - JndiManagerClassName\n                                                             - JndiManagerClassPackageAndName\n\n                                                             Example:\n                                                             --finding-match classFileMd5 and --finding-match jarFileObfuscated would only delete a file containing a vulnerability if the vulnerability contains a class file hash match and an obfuscated jar name.\n                                                             If a vulnerable finding contained only one of these finding-match values then the file would not be considered for deletion.\n\n  -h, --help                                                 help for delete\n      --ignore-dir strings                                   Specify directory pattern to ignore. Use multiple times to supply multiple patterns.\n                                                             Patterns should be relative to the provided root.\n                                                             e.g. ignore \"^/proc\" to ignore \"/proc\" when using a crawl root of \"/\"\n      --maximum-average-obfuscated-class-name-length int     The maximum class name length for a class to be considered obfuscated. (default 3)\n      --maximum-average-obfuscated-package-name-length int   The maximum average package name length a class to be considered obfuscated. (default 3)\n      --nested-archive-disk-swap-dir string                  When nested-archive-disk-swap-max-size is non-zero, this is the directory in which temporary files will be created for writing temporary large nested archives to disk. (default \"/tmp\")\n      --nested-archive-disk-swap-max-size uint               The maximum size in bytes of disk space allowed to use for inspecting nest archives that are over the nested-archive-max-size.\n                                                             By default no disk swap is to be allowed, nested archives will only be inspected if they fit into the configured nested-archive-max-size.\n                                                             When an archive is encountered that is over the nested-archive-max-size, an the archive may be written out to a temporary file so that it can be inspected without a large memory penalty.\n                                                             If large archives are nested within each other, an archive will be opened only if the accumulated space used for archives on disk would not exceed the configured nested-archive-disk-swap-max-size.\n      --nested-archive-max-depth uint                        The maximum depth to recurse into nested archives.\n                                                             A max depth of 0 will open up an archive on the filesystem but not any nested archives.\n      --nested-archive-max-size uint                         The maximum compressed size in bytes of any nested archive that will be unarchived for inspection.\n                                                             This limit is made a per-depth level.\n                                                             The overall limit to nested archive size unarchived should be controlled\n                                                             by both the nested-archive-max-size and nested-archive-max-depth. (default 5242880)\n      --per-archive-timeout duration                         If this duration is exceeded when inspecting an archive,\n                                                             an error will be logged and the crawler will move onto the next file. (default 15m0s)\n      --skip-owner-check                                     When provided, the owner of a file will not be checked before attempting a delete.\n```\n\nIdentify command\n================\n\n```\nProduces hashes to identify a class file within a JAR.\nThe entire class is hashed to allow for matching against the exact version.\nThe bytecode opcodes making up the methods are hashed, for matching versions\nwith modifications.\nUse the class-name option to change which class is analysed within the JAR.\n\nUsage:\n  log4j-sniffer identify \u003cjar\u003e [flags]\n\nFlags:\n      --class-name string   Specify the full class name and package to scan.\n                            Defaults to the log4j JdniManager class. (default \"org.apache.logging.log4j.core.net.JndiManager\")\n  -h, --help                help for identify\n\n\n```\n\nIdentify runs against a Jar and produces both an md5 hash and a bytecode instruction hash. The primary purpose for this command is generating signatures for the crawl command.\n\nExample output:\n```\n$ log4j-sniffer identify examples/single_bad_version/log4j-core-2.14.1.jar \nSize of class: 5029\nHash of complete class: f1d630c48928096a484e4b95ccb162a0\nHash of all bytecode instructions: 8139e14cd3955ef709139c3f23d38057-v0\n```\n\nCompare command\n===============\n\n```\nCompares the classes specified within source_jar and target_jar.\nOutputs the parts the jars have in common in order to build signatures for matching.\nThe class names must be fully qualified and not end with .class.\n\nUsage:\n  log4j-sniffer compare \u003csource_jar\u003e \u003cclass\u003e \u003ctarget_jar\u003e \u003cclass\u003e [flags]\n\nFlags:\n  -h, --help   help for compare\n```\n\nCompare two classes and output similar bytecode in hex encoding. The primary purpose of this command is to produce signatures for partial bytecode matching. It is not intended to provide useful output if run against Jar files of unknown construction.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpalantir%2Flog4j-sniffer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpalantir%2Flog4j-sniffer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpalantir%2Flog4j-sniffer/lists"}