来源

关联漏洞

描述

Test case to check if the Log4Shell/CVE-2021-44228 hotfix will raise any unexpected exceptions

介绍

Log4Shell Hotfix Side Effect Test Case
======================================

I wanted to know if any `ClassNotFoundException` or similar unexpected
exception is raised when one applies the CVE-2021-44228 aka Log4Shell
hotfix as recommended [here](https://logging.apache.org/log4j/2.x/security.html#Fixed_in_Log4j_2.16.0).

Result: It looks like no exception is bubbling up.

To test this execute the following commands:
```
./gradlew clean installDist
env JAVA_OPTS=-Xmx64M ./build/install/log4shell-hotfix-side-effect/bin/log4shell-hotfix-side-effect
```

It will log a bunch of messages and timings and there should be no exceptions.

If the log4j jar file is not patched properly there should be a measurable
delay between the messages (or you might even get an RCE, YMMV).

文件快照

 [4.0K]  /data/pocs/9fda486651458c6bc6550a83e962c242f04f8d42
├── [ 821]  build.gradle
├── [4.0K]  gradle
│   └── [4.0K]  wrapper
│       ├── [ 54K]  gradle-wrapper.jar
│       └── [ 202]  gradle-wrapper.properties
├── [5.2K]  gradlew
├── [2.2K]  gradlew.bat
├── [ 779]  README.md
└── [4.0K]  src
    └── [4.0K]  main
        └── [4.0K]  java
            └── [4.0K]  de
                └── [4.0K]  silpion
                    └── [4.0K]  log4shell
                        └── [4.0K]  hotfix
                            └── [4.0K]  side
                                └── [4.0K]  effect
                                    ├── [1.8K]  Log.java
                                    └── [3.4K]  Main.java

11 directories, 8 files

备注