How to find vulnerable log4j programs (CVE-2021-44228) on a Windows 10 PC and how to provide first-aid when I cannot update to a fixed version?

Question

How can I find vulnerable Log4j programs (CVE-2021-44228) on a Windows 10 PC and how can I provide first aid when I cannot update to a fixed Log4j version?

Answer 1

It is possible to delete the JndiLookup class from log4j-core JAR files in order to provide first aid in the context of the Log4j security disaster (CVE-2021-44228).

Delete the JndiLookup classes, if you cannot update the Java application to a version with a fixed Log4j version, as it is suggested by Log4j themselves.

So this is just a first-aid quick fix until you get application updates! The following PowerShell script will search all drives for log4j-core*.jar files. In any found one, we will delete the JndiLookup class from it, with the "zip -q -d" command.

On Windows 10 PCs, there is PowerShell for scripting. Thus, create an anyname.ps1 file with the following content:

# Ensure we can run everything
Set-ExecutionPolicy Bypass -Scope Process -Force

# Escape characters in PowerShell: https://ss64.com/ps/syntax-esc.html

Write-Host "Start iterating drives..."
$volumes = Get-WmiObject win32_volume -filter "drivetype=3"
foreach ($volume in $volumes)
{
    $driveletter = $volume.driveletter # e.g. C:
    if ($driveletter -ne $null)
    {
        $drivename   = $volume.name        # e.g. C:\

        Write-Host "`n== Checking $driveletter... =="

        # Find log4j-core*.jar files, directly
        # and remove org/apache/logging/log4j/core/lookup/JndiLookup.class
        # with zip.exe -q -d command.
        # Use unzip -l | findstr JndiLookup as paranoia check.
        Write-Host "== Find log4j-core*.jar files... =="
            Get-ChildItem -Path $drivename -Filter log4j-core*.jar -Recurse -ErrorAction SilentlyContinue | % {
            Write-Host "== $($_.FullName) =="

            Write-Host "> zip.exe -q -d `"$($_.FullName)`" `"org/apache/logging/log4j/core/lookup/JndiLookup.class`""
            zip.exe -q -d "$($_.FullName)" "org/apache/logging/log4j/core/lookup/JndiLookup.class"

            Write-Host "> unzip.exe -l `"$($_.FullName)`" | findstr JndiLookup"
            unzip.exe -l "$($_.FullName)" | findstr JndiLookup

            Write-Host "== END =="
        }

        # Find JndiLookup.class in uncompressed directories on the file-system (aka *.class)
        Write-Host "== Find uncompressed JndiLookup.class files... =="
        Get-ChildItem -Path $drivename -Filter JndiLookup.class -Recurse -ErrorAction SilentlyContinue | % {
            Write-Host "== $($_.FullName) =="

            Write-Host "> Remove-Item -Path `"$($_.FullName)`" -Force"
            Remove-Item -Path $_.FullName -Force

            Write-Host "== END =="
        }
    }
}

# Find embedded log4j-core*.jar files ("Java Über JARs" or shaded JARs, i.e., JARs in other JAR/WAR/etc.)
Write-Host "== Find log4j-core*.jar files that are embedded into other archives... =="
Write-Host "TODO: Not supported!"
Write-Host "INSTEAD APPLY: https://github.com/mergebase/log4j-detector"

# Find log4j in docker containers
Write-Host "== Find log4j in docker containers... =="
Write-Host "TODO: Not supported!"
Write-Host "READ: https://www.docker.com/blog/apache-log4j-2-cve-2021-44228/"
Write-Host "THUS, APPLY: docker scan"

Write-Host "Press ENTER to continue..."
cmd /c Pause | Out-Null

Now you can execute this .ps1 file.

An easy way to execute the .ps1 file: create an anyname.cmd file besides the identically named .ps1 file with the following content:

powershell.exe -ExecutionPolicy ByPass -noprofile -command "&{start-process powershell -ArgumentList '-ExecutionPolicy ByPass -noprofile -NoExit -file \"%~dpn0.ps1\"' -verb RunAs}"

You can double-click the cmd. It will execute the .ps1 script with elevated privileges.

There have been several attempted fixes by log4j (versions 2.15, 2.16 and now 2.17). Possibly, the "first-aid" removal of JndiLookup class (from any log4j JARs, possibly embedded, i.e., "Java Über JARs" or shaded JARs, or in uncompressed directories on the file-system, aka *.class) should actually be your preferred present and future option.