{"uuid": "833128f4-9894-4af0-b624-bbd2305a0421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44228", "type": "seen", "source": "https://t.me/cissp/4946", "content": "log4j2-scan is a single binary command-line tool for CVE-2021-44228 vulnerability scanning and mitigation patch. It also supports nested JAR file scanning and patch.\n\nDownload\nlog4j2-scan 1.2.5 (Windows x64)\nlog4j2-scan 1.2.5 (Linux x64)\nlog4j2-scan 1.2.5 (Any OS, 10KB)\nHow to use\nJust run log4j2-scan.exe or log4j2-scan with target directory path.\n\nOn Windows\n\nlog4j2-scan [--fix] [--trace] target_path\nOn Linux\n\n./log4j2-scan [--fix] [--trace] target_path\nOn UNIX (AIX, Solaris, and so on)\n\njava -jar logpresso-log4j2-scan-1.2.5.jar [--fix] [--trace] target_path\nIf you add --fix option, this program will copy vulnerable original JAR file to .bak file, and create new JAR file without org/apache/logging/log4j/core/lookup/JndiLookup.class entry. In most environments, JNDI lookup feature will not be used. However, you must use this option at your own risk. It is necessary to shutdown any running JVM process before applying patch. Start affected JVM process after fix.\n\nIf you want to automate patch job, use --force-fix option. With this option, this program will no longer prompt for confirmation.\n\n(mitigated) tag will be displayed if org/apache/logging/log4j/core/lookup/JndiLookup.class entry is removed from JAR file.\n\nIf you add --trace option, this program will print all visited directories and files. Use this option only for debugging.\n\nOn Windows:\n\nCMD> log4j2-scan.exe D:\\tmp\n[*] Found CVE-2021-44228 vulnerability in D:\\tmp\\elasticsearch-7.16.0\\bin\\elasticsearch-sql-cli-7.16.0.jar, log4j 2.11.1\n[*] Found CVE-2021-44228 vulnerability in D:\\tmp\\elasticsearch-7.16.0\\lib\\log4j-core-2.11.1.jar, log4j 2.11.1\n[*] Found CVE-2021-44228 vulnerability in D:\\tmp\\flink-1.14.0\\lib\\log4j-core-2.14.1.jar, log4j 2.14.1\n[*] Found CVE-2021-44228 vulnerability in D:\\tmp\\logstash-7.16.0\\logstash-core\\lib\\jars\\log4j-core-2.14.0.jar, log4j 2.14.0\n[*] Found CVE-2021-44228 vulnerability in D:\\tmp\\logstash-7.16.0\\vendor\\bundle\\jruby\\2.5.0\\gems\\logstash-input-tcp-6.2.1-java\\vendor\\jar-dependencies\\org\\logstash\\inputs\\logstash-input-tcp\\6.2.1\\logstash-input-tcp-6.2.1.jar, log4j 2.9.1\n[*] Found CVE-2021-44228 vulnerability in D:\\tmp\\solr-7.7.3\\solr-7.7.3\\contrib\\prometheus-exporter\\lib\\log4j-core-2.11.0.jar, log4j 2.11.0\n[*] Found CVE-2021-44228 vulnerability in D:\\tmp\\solr-7.7.3\\solr-7.7.3\\server\\lib\\ext\\log4j-core-2.11.0.jar, log4j 2.11.0\n[*] Found CVE-2021-44228 vulnerability in D:\\tmp\\solr-8.11.0\\contrib\\prometheus-exporter\\lib\\log4j-core-2.14.1.jar, log4j 2.14.1\n[*] Found CVE-2021-44228 vulnerability in D:\\tmp\\solr-8.11.0\\server\\lib\\ext\\log4j-core-2.14.1.jar, log4j 2.14.1\n\nScanned 5047 directories and 26251 files\nFound 9 vulnerable files\nCompleted in 0.42 seconds\nhttps://github.com/logpresso/CVE-2021-44228-Scanner", "creation_timestamp": "2026-09-01T17:00:33.740775Z"}