Possible Log4j Scan hit on latest version of 2.3

[Fenr1r-g]

Hello all,

I searched through the old posts for log4j fixes before this and believe this is a new find that our tenable instance hit on

I initially believed this to be a false positive, but after pulling down the jar file and running a "Jar -tf | grep Jndi" I found the vulnerable lookup class in it.

Not sure what this file is being used for, but would appreciate confirmation from the team before re-rolling this finding as a false positive.

[dougburks]

What is the output of the following?

cat /etc/soversion

[Fenr1r-g]

/source/logstash/logstash-core/src/test/resources/org/logstash/plugins/logstash-input-java_input_example-0.0.1.jar

[dougburks]

There shouldn't be a /source directory on a default Security Onion 2.3.260 installation:

ls /source
ls: cannot access /source: No such file or directory

[Fenr1r-g]

This is an Azure VM. Sorry, I should've specified this ahead of time.

[dougburks]

In that case, yes, cloud images do have a /source directory. This is a snapshot of the source code from all major third-party products included with Security Onion. However, no services actually run from there. You can safely remove that folder.

[Fenr1r-g]

Awesome, thanks Doug!