How to check Log4j in Magento installation?

Question

I don't know if my Magento server is infected by Log4j, how could I check it?

Answer 1

If you have ElasticSearch installed, the chances are that you have a vulnerability in your server. You need to update your ElasticSearch to the version launched Dec 13, 2021.

Running this command below you can check the Log4j version installed, the versions 2.0 to 2.14.1 are affected.

dpkg -l|grep log4j;

You can find more details here.

Answer 2

As i read on Elastic (elastic.co) older Log4J versions could be also vulnerable too. This might be relevant for older Magento 2 installations with an older ElasticSearch setup or even for Magento 1 Shops that get patches from MageOne using ElasticSearch. If updating ElasticSearch is not an possible, setting the Dlog4j2 formatMsgNoLookups option to true should stop the lookup function and fix the gap.

In versions 1.17.0-1.28.0, the issue can be mitigated manually by setting system property -Dlog4j2.formatMsgNoLookups=true.

On my setup I found the options file at /etc/elasticsearch/jvm.options, added the option and restarted ElasticSearch afterwards.

To get fully sure that log4j on other setups with Magento is not installed i also checked for relevant .jar files.

find / -name '*.jar'

Sometimes the log4j jar can be packed into another jar as mentioned in that post. So this simple find statement wouldn't find it. For that you can search for the class "JndiLookup" in packed jar files with

sudo find / -name *.jar -exec sh -c "if zipinfo {} | grep JndiLookup; then echo -e '{}\n'; fi" ;

See video on u-labs.de