A mitigation for CVE-2021-44228 (log4shell) that works by patching the vulnerability at runtime. (Works with any vulnerable java software, tested with java 6 and newer)# Log4jPatcher
A Java Agent based mitigation for Log4j2 JNDI exploits.
This agent employs 2 patches:
- Disabling all Lookup conversions (on supported Log4j versions)
in `org.apache.logging.log4j.core.pattern.MessagePatternConverter` by setting `noLookups` to true in the constructor.
- Disabling the `org.apache.logging.log4j.core.lookup.JndiLookup` class by just returning `null`
in its `lookup` function.
### To use
Download the latest release available from GitHub:
https://github.com/CreeperHost/Log4jPatcher/releases
Add `-javaagent:Log4jPatcher.jar` as a JVM argument.
For Minecraft users:
The full path to the jar needs to be added in the above argument unless the jar is put into the instance (or .minecraft) folder.
This jar does not go into the mods folder.
You can find a guide for Minecraft here:
https://www.creeperhost.net/wiki/books/minecraft-java-edition/page/mitigating-cve-2021-44228-in-minecraft
[4.0K] /data/pocs/2c4472c3d440e1f55c89f40557110581292efa2c
├── [ 898] build.gradle
├── [4.0K] gradle
│ └── [4.0K] wrapper
│ ├── [ 58K] gradle-wrapper.jar
│ └── [ 200] gradle-wrapper.properties
├── [5.6K] gradlew
├── [2.6K] gradlew.bat
├── [ 141] LICENSE-header.txt
├── [1.0K] LICENSE.txt
├── [ 930] README.md
├── [ 35] settings.gradle
└── [4.0K] src
└── [4.0K] main
└── [4.0K] java
└── [4.0K] net
└── [4.0K] creeperhost
└── [4.0K] log4jpatcher
├── [1.6K] JndiLookupTransformer.java
├── [ 682] Main.java
├── [2.0K] MessagePatternTransformer.java
└── [2.9K] Transformer.java
8 directories, 13 files