Log4j CVE-2021-44228 Detection and Mitigation

Seems like this is working:

run /bin/sh -c "chmod +x /tmp/log4j2-scan"
run /bin/sh -c "cd /tmp && ./log4j2-scan --exclude /mnt --exclude /cdrom --exclude /dev / > /var/opt/BESClient/BPS-Scans/results-log4j2-scan.txt"

I need to test it with the newer relevance now.

I’m not even sure the chmod is making a difference. I should test it without it, but for now, I’ll leave it in.

This should be working now: bigfix-content/fixlet/Logpresso log4j2-scan - Linux x64.bes at main · jgstew/bigfix-content · GitHub

2 Likes

I added run /bin/sh -c “chmod +x /tmp/log4j2-scan” to the existing action, still not working.

Did the action execute via BigFix for you ?

Yes, but the other actual run command is also different. I changed both. I don’t think chmod was the fix. Run it from the github.

I think the real issue is I was using single quotes around the command while I should have been using double quotes because for some reason that tends to work better with BigFix if the very outer quotes are double quotes, even though bash and sh don’t care themselves.

1 Like

Awesome, works perfectly. You da man ! Thank you !

1 Like

I removed the chmod line, still worked. It doesn’t hurt to keep it, but I also don’t think it does anything at all.

Also, if you need to dynamically look up /bin/sh instead of hard coding it, you can do something like this:

tuple string items 0 of concatenations ", " of ( it ; pathnames of files whose(name of it as lowercase = "sh" OR name of it as lowercase = "sh.exe") of (folders it) of unique values of (it as trimmed string) of substrings separated by (";";":") of values of (variables "PATH" of it; (if (windows of operating system) then (x64 variables "PATH" of it) else NOTHINGS) ) of environments ) of "/bin/sh"

This will take the first instance of sh found in the PATH, but will return /bin/sh if not found in PATH.

1 Like

@jgstew I’m getting an exit 2 on your logpresso fixlet for unix - can’t see where it’s coming from though :frowning:

I’ve had to modify the download location to a local one as our servers don’t have internet access but I wou;dn’t imagine that would cause it?

Logpresso itself is odd with exit codes. Check the output log file it generated to see whether it ran correctly.

With Logpresso, ‘-1’ is an error exit code, anything else is the number of vulnerable files it found. So you may just have 2 vulnerable files found.

1 Like

You shouldn’t have to do this because the download comes from the root server and relays, the client does not download the file itself.

What flavor of Unix? I’m not even sure this binary compiled from JAVA runs on anything other than Linux. You may have to run the JAR version for Unix.

From the doc: GitHub - logpresso/CVE-2021-44228-Scanner: Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228

On UNIX (AIX, Solaris, and so on)

java -jar logpresso-log4j2-scan-1.7.0.jar [--fix] target_path

You might need to use Java version 11 or earlier for this option to work ^

Ahhh it was Linux CentOS 7.5.1804 (3.10.0-862.11.6.el7.x86_64)

Odd, that should work as far as I know! Are you using the newest item on github? updated recently?

@FatScottishGuy @jgstew did you see my note that Logpresso’s exit code indicates the number of vulnerable files it found?

Oh, so exit code 2 may mean it succeeded then? That makes sense.

Need to check the analysis for results. As long as it reports fixed in the action result that should mean the file is created with results.

1 Like

Fyi, everyone, Logpresso just published a new version 1.7.0

2 Likes

mine was a fail with exit code 2

Does it work if you run the binary by hand on that platform? What kind of feedback does it give?

I wonder if it is compiled with Debian family and then it doesn’t work for RHEL family?

It’s working on my CentOS 7.9

1 Like

Sorry if this has been addressed upthread…

If a .jar file has been renamed to remove the version string, how can we poke inside to discover the version?

The Logpresso scan looks like it handles that part. I am strongly inclined to deprecate everything else we’ve written for this and use Logpresso for all the things.

(Which, I know, leaves a lot of OSes in the cold now, but I’m more inclined to get Logpresso working on those instead of trying to push further with shell scripts)

4 Likes

Is there a way to run the logpresso tool in --fix mode without having to tell it “y”?

When I’ve tested this on Linux and Windows and both systems require a user prompt when attempting to “–fix” the issues found. I’m reluctant to run it in an Action when it might sit there waiting for a use response that will never come.

Yes there is…instead of using ‘--fix’, use ‘--force-fix’ to run the fixes without prompting for confirmation.

--force-fix
        Do not prompt confirmation. Don't use this option unless you know what you are doing.

As with all the rest of the community content here, test test test

2 Likes