关联漏洞
标题：
Apache Log4j 输入验证错误漏洞
(CVE-2021-44832)
描述：Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。 Apache Log4j2 2.0-beta7 到 2.17.0版本存在注入漏洞，该漏洞源于软件中对于JDBC Appender 和JNDI 缺少有效的防护与过滤。有权修改日志配置文件的攻击者可以构建恶意配置 将 JDBC Appender 与引用 JNDI URI 的数据源一起使用，该 JNDI URI 可以执行远程代码。
描述
Discover Log4Shell vulnerability [CVE-2021-44832]
介绍
# Log4j Scanner
Discover Log4Shell vulnerability [CVE-2021-44832] in your files and directories.
## Description
This Rust-based Log4j Scanner is designed to help you identify and locate vulnerable files that may contain the Log4Shell vulnerability [CVE-2021-44832]. It scans files and directories to find instances of Logger.class files with "log4j" in their names or JAR files that do not contain "2.17.1" in their names.
## Features
- Scan files and directories for Log4j vulnerabilities.
- Detect Logger.class files with "log4j" in their names.
- Identify JAR files without "2.17.1" in their names.
- Display the path to vulnerable files when found.
## Usage
1. Clone this repository to your local machine.
```bash
git clone https://github.com/yourusername/log4j-scanner.git
cd log4j-scanner
```
2. Build the project using Cargo.
```bash
cargo build --release
```
3. Run the Log4j Scanner with the desired path to scan.
```bash
./target/release/log4j-scanner /path/to/scan
```
Replace /path/to/scan with the directory you want to scan for Log4j vulnerabilities.
## Output
The scanner will display messages indicating the progress and any discovered vulnerable files.
## Contributing
Contributions are welcome! If you find a bug or have suggestions for improvement, please create an issue or submit a pull request.
文件快照
[4.0K] /data/pocs/e515e38c72c9feec651f6739260badab6391e3a2
├── [ 338] Cargo.toml
├── [ 34K] LICENSE
├── [1.3K] README.md
└── [4.0K] src
└── [2.6K] main.rs
1 directory, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。