Log4j 是很严重的安装漏洞, 影响也很广泛, 骇客可以透过 Log4j 漏洞执行指令, Log4j 漏洞在 CVSS 评分高达 10.0, 所以十分值得关注。本文会讲述测试系统是否存在 Log4j 漏洞的方法。
已经有人写了在 Linux 检查 Log4j 漏洞的 Shell Script，虽然目前还是 beta 版, 不保证有 100% 检测成功率, 因为这个 Shell Script 不会检查应用程式包装的 jar 档, 但还是很好的工具开始检测。
要执行检测系统是否存在 Log4j 漏洞, 执行以下指令:
|
1 |
# wget https://raw.githubusercontent.com/rubo77/log4j_checker_beta/main/log4j_checker_beta.sh -q -O - | bash |
没有检测到 Log4j 漏洞会出现以下结果:
|
1 2 3 4 5 6 7 8 9 10 11 |
[INFO] Looking for files containing log4j... [INFO] No files containing log4j [INFO] Checking installed packages Solr ElasticSearch and packages containing log4j [INFO] No yum packages found [INFO] Checking if Java is installed... [INFO] Java is not installed [INFO] Analyzing JAR/WAR/EAR files... [INFO] _________________________________________________ [WARNING] Some apps bundle the vulnerable library in their own compiled package, so 'java' might not be installed but one such apps could still be vulnerable. [WARNING] This whole script is not 100% proof you are not vulnerable, but a strong hint |
请留意这个 Shell Script 并不保证完全检测成功, 但还是很好的开始检查方向, 当没有发现 Log4j 漏洞后, 建议还是继续留意各厂商的 Log4j 更新。