1E Verified
Copyright © 1E 2022 All Rights Reserved
Log4j Vulnerability
Downloads
127
Endorsements
21
Components
6
Added
2 years ago
Last Updated
8 months ago
Compatibility
Client Supported - 23.7, 8.1, 8.2, 8.4, 9.0
Description
This product pack is intended to address various aspects of CVE-2021-44228, CVE-2021-45046 or CVE-2021-45105, collectively known as the log4j vulnerability.
Key Features
- List all the Jar file and its content.
- Search Jar files.
- Set environmental variables.
Setup
- This Product Pack contains both Rules and instructions.
- Upload this Product pack with the help of Tachyon Product Pack Deployment Tool.
- A Guaranteed State Policy named Policy Log4j Includes v1 will be created.
- Four Guaranteed State Rules will be created in this policy.
- An Instruction Set named Log4j Vulnerability containing all the instructions will be created.
Usage
- Review any rule, for example Rule-Includes-Table-Log4j-VulnerableVersions.
- Adjust the Trigger IntervalHours to run it on a periodic basis.
- The Check is performed to determine if Table.Log4j.VulnerableVersions code is stored and hasn't been modified from the original.
- Enable this rule.
- Assign the Policy Log4j Includes v1 Policy to a management group.
- Deploy the Policy Log4j Includes v1 Policy.
- Within a period of a day or two you would start seeing the compliance and remediation reports on Log4j.
- We can also manually run instruction from Explorer to perform additional tasks.
Components
1E-Exchange-Log4j-ListJarFiles
INSTRUCTION
Description
Log4J: List jar files matching Pattern for CVE-2021-44228, CVE-2021-45046, CVE-2021-45105
Readable Payload
Log4J: List jar files matching "%Pattern%" using fast algorithm %FindFast% for CVE-2021-44228, CVE-2021-45046, CVE-2021-45105
1E-Exchange-Log4j-RemoveJarFileContent
INSTRUCTION
Description
Log4J: Search inside jar files matching a pattern for files matching a list of patterns and remove/delete them for CVE-2021-44228, CVE-2021-45046, CVE-2021-45105
Readable Payload
Log4J: Search inside jar files matching pattern %Pattern% using optional find fast algorithm %FindFast% for files matching a list of patterns %PackagedFilePatterns% matching Log4j Implementation-Version regex %VersionRegEx% and remove them from the jar %Action%