#!/bin/bash
# Find and identify vulnerable log4j2 jar files
# /u/whetu, 2021-12-16

service_name="log4shell"

# This must be run as root or with sudo
if (( "${EUID:$(id -u)}" != 0 )); then
  printf -- '%s\n' "1 ${service_name} - This must be run as root"
  # checkmk local checks need to exit 0, folks
  exit 0
fi

# It might be feasible to check if java is actually present and short circuit here

# From https://raw.githubusercontent.com/mubix/CVE-2021-44228-Log4Shell-Hashes/main/md5sum.txt
# With the addition of an md5sum for 2.15.0 (i.e. CVE-2021-45046, CVSSv3 3.7)
affected_md5sums=(
    2addabe2ceca2145955c02a6182f7fc5
    5b1d4e4eea828a724c8b0237326829b3
    ce9e9a27c2a5caa47754999eb9c549b8
    1538d8c342e3e2a31cd16e01e3865276
    9cb138881a317a7f49c74c3e462f35f4
    578ffc5bcccb29f6be2d23176c0425e0
    5b73a0ad257c57e7441778edee4620a7
    e32489039dab38637557882cca0653d7
    db025370dbe801ac623382edb2336ede
    152ecb3ce094ac5bc9ea39d6122e2814
    cd70a1888ecdd311c1990e784867ce1e
    088df113ad249ab72bf19b7f00b863d5
    de8d01cc15fd0c74fea8bbb668e289f5
    fbfa5f33ab4b29a6fdd52473ee7b834d
    8c0cf3eb047154a4f8e16daf5a209319
    8d331544b2e7b20ad166debca2550d73
    5e4bca5ed20b94ab19bb65836da93f96
    110ab3e3e4f3780921e8ee5dde3373ad
    0079c907230659968f0fc0e41a6abcf9
    f0c43adaca2afc71c6cc80f851b38818
    dd0e3e0b404083ec69618aabb50b8ac0
    5523f144faef2bfca08a3ca8b2becd6a
    48f7f3cda53030a87e8c387d8d1e4265
    472c8e1fbaa0e61520e025c255b5d168
    2b63e0e5063fdaccf669a1e26384f3fd
    c6d233bc8e9cfe5da690059d27d9f88f
    547bb3ed2deb856d0e3bbd77c27b9625
    4a5177a172764bda6f4472b94ba17ccb
    a27e67868b69b7223576d6e8511659dd
    a3a6bc23ffc5615efcb637e9fd8be7ec
    0042e7de635dc1c6c0c5a1ebd2c1c416
    90c12763ac2a49966dbb9a6d98be361d
    71d3394226547d81d1bf6373a5b0e53a
    8da9b75725fb3357cb9872adf7711f9f
    7943c49b634b404144557181f550a59c
    df949e7d73479ab717e5770814de0ae9
    2803991d51c98421be35d2db4ed3c2ac
    5ff1dab00c278ab8c7d46aadc60b4074
    b8e0d2779abbf38586b869f8b8e2eb46
    46e660d79456e6f751c22b94976f6ad5
    62ad26fbfb783183663ba5bfdbfb5ace
    3570d00d9ceb3ca645d6927f15c03a62
    f5e2d2a9543ee3c4339b6f90b6cb01fc
    5985349db390cb5b11cb5f9a5c398a8d
)

# Lifted from https://stackoverflow.com/a/57536163
array::join() {
    (($#)) || return 1 # At least delimiter required
    local -- delim="$1" str IFS=
    shift
    str="${*/#/$delim}" # Expand arguments with prefixed delimiter (Empty IFS)
    echo "${str:${#delim}}" # Echo without first delimiter
}

# Usage: in_array "string" "arrayname"
in_array() {
    local string element
    string="${1}"
    shift
    # Iterate through the array elements
    for element; do
        [[ "${element}" = "${string}" ]] && return 0
    done
    # If we get to this point, nothing matched, so we return 1
    return 1
}

locate_log4j_files() {
    if command -v locate >/dev/null 2>&1; then
        locate -r log4j.*.jar
    else
        find /var /etc /usr /opt /lib* /home -type f -name "log4j.*.jar" 2>&1 |
            grep -Ev '^find:.* Permission denied$|^find:.* No such file or directory$'
    fi
}

locate_jar_files() {
    if command -v locate >/dev/null 2>&1; then
        locate -r '.jar$|.war$|.ear$'
    else
        find /var /etc /usr /opt /lib* /home -type f -name "*.jar" -o -name "*.war" -o -name "*.ear" 2>&1 |
            grep -Ev '^find:.* Permission denied$|^find:.* No such file or directory$'
    fi
}

# First we look for files with obvious names and compare their md5 hashes
mapfile -t log4j_files < <(locate_log4j_files)
vulnerable_count=0
for file_path in "${log4j_files[@]}"; do
    md5_string="$(md5sum "${file_path}" | awk '{print $1}')"
    found_paths+=( "${file_path}" )
    in_array "${md5_string}" "${affected_md5sums[@]}" && (( ++vulnerable_count ))
done

# Next we audit all jar/war/ear files
# We filter our already found files from above in order to de-duplicate
mapfile -t jar_files < <(locate_jar_files | grep -v -f <(printf -- '%s\n' "${log4j_files[@]}"))

class_found_count=0
for file_path in "${jar_files[@]}"; do
    if grep -q JndiLookup.class "${file_path}"; then
        found_paths+=( "${file_path}" )
        (( ++class_found_count ))
    fi
done

# TO-DO: Recursively unzip jar files

# Build our output
out_message="P ${service_name} vulnerable_file_count=${vulnerable_count};1;1"
out_message="${out_message}|vulnerable_class_count=${class_found_count};1;1"
if (( "${#found_paths[@]}" > 0 )); then
    out_message="${out_message} Potential vulnerabilities found in the following files\n"
    out_message="${out_message}$(array::join '\n' "${found_paths[@]}")"
else
    out_message="${out_message} No vulnerable files or classes found by this check."
fi

printf -- '%s\n' "${out_message}"