My Java 11 application is being upgraded to fix the log4shell flaw. So first Spring Boot has been upgraded to the latest version.
As my project uses Maven to manage its dependencies, I set the log4j version in the dependencyManagement section so that anywhere log4j is used the latest version is picked up :
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-bom</artifactId>
<version>2.17.2</version>
<scope>import</scope>
<type>pom</type>
</dependency>
</dependencies>
</dependencyManagement>
When I give mvn dependency:tree a shot to see which library versions are actually used I can see that log4j-api and log4j-to-slf4j versions are the latest ones (2.17.2) as you would expect :
+- org.hibernate:hibernate-core:jar:5.6.5.Final:compile
| | +- org.jboss.logging:jboss-logging:jar:3.4.3.Final:compile
| | +- javax.persistence:javax.persistence-api:jar:2.2:compile
| | +- net.bytebuddy:byte-buddy:jar:1.11.22:compile
| | +- antlr:antlr:jar:2.7.7:compile
| | +- org.jboss.spec.javax.transaction:jboss-transaction-api_1.2_spec:jar:1.1.1.Final:compile
| | +- org.jboss:jandex:jar:2.4.2.Final:compile
| | +- com.fasterxml:classmate:jar:1.5.1:compile
| | +- javax.activation:javax.activation-api:jar:1.2.0:compile
| | +- org.hibernate.common:hibernate-commons-annotations:jar:5.1.2.Final:compile
| | \- org.glassfish.jaxb:jaxb-runtime:jar:2.3.6:compile
| | +- org.glassfish.jaxb:txw2:jar:2.3.6:compile
| | \- com.sun.istack:istack-commons-runtime:jar:3.0.12:compile
| +- org.javassist:javassist:jar:3.23.1-GA:compile
| +- org.apache.solr:solr-solrj:jar:7.4.0:compile
| | +- org.apache.commons:commons-math3:jar:3.6.1:compile
| | +- org.apache.httpcomponents:httpclient:jar:4.5.13:compile
| | +- org.apache.httpcomponents:httpcore:jar:4.4.15:compile
| | +- org.apache.httpcomponents:httpmime:jar:4.5.13:compile
| | +- org.apache.zookeeper:zookeeper:jar:3.4.11:compile
| | +- org.codehaus.woodstox:stax2-api:jar:3.1.4:compile
| | +- org.codehaus.woodstox:woodstox-core-asl:jar:4.4.1:compile
| | +- org.noggit:noggit:jar:0.8:compile
| | \- org.slf4j:slf4j-api:jar:1.7.36:compile
| +- com.google.code.gson:gson:jar:2.8.9:compile
| +- net.imagej:ij:jar:1.52q:compile
| +- commons-codec:commons-codec:jar:1.15:compile
| +- org.apache.commons:commons-text:jar:1.6:compile
| +- net.coobird:thumbnailator:jar:0.4.13:compile
| +- com.github.jai-imageio:jai-imageio-jpeg2000:jar:1.4.0:compile
| | \- com.github.jai-imageio:jai-imageio-core:jar:1.4.0:compile
| +- org.apache.pdfbox:jbig2-imageio:jar:3.0.2:compile
| +- org.apache.tika:tika-core:jar:2.3.0:compile
| | \- commons-io:commons-io:jar:2.11.0:compile
| +- org.apache.tika:tika-parsers-standard-package:jar:2.3.0:compile
| | +- org.apache.tika:tika-parser-apple-module:jar:2.3.0:compile
| | | +- org.apache.tika:tika-parser-zip-commons:jar:2.3.0:compile
| | | | \- org.apache.commons:commons-compress:jar:1.21:compile
| | | \- com.googlecode.plist:dd-plist:jar:1.23:compile
| | +- org.apache.tika:tika-parser-audiovideo-module:jar:2.3.0:compile
| | | \- com.drewnoakes:metadata-extractor:jar:2.16.0:compile
| | | \- com.adobe.xmp:xmpcore:jar:6.1.11:compile
| | +- org.apache.tika:tika-parser-cad-module:jar:2.3.0:compile
| | | \- org.apache.poi:poi:jar:5.2.0:compile
| | | \- com.zaxxer:SparseBitSet:jar:1.2:compile
| | +- org.apache.tika:tika-parser-code-module:jar:2.3.0:compile
| | | +- org.codelibs:jhighlight:jar:1.0.3:compile
| | | +- org.ccil.cowan.tagsoup:tagsoup:jar:1.2.1:compile
| | | +- org.ow2.asm:asm:jar:9.2:compile
| | | +- com.epam:parso:jar:2.0.14:compile
| | | \- org.tallison:jmatio:jar:1.5:compile
| | +- org.apache.tika:tika-parser-crypto-module:jar:2.3.0:compile
| | | +- org.bouncycastle:bcmail-jdk15on:jar:1.70:compile
| | | | +- org.bouncycastle:bcutil-jdk15on:jar:1.70:compile
| | | | \- org.bouncycastle:bcpkix-jdk15on:jar:1.70:compile
| | | \- org.bouncycastle:bcprov-jdk15on:jar:1.70:compile
| | +- org.apache.tika:tika-parser-digest-commons:jar:2.3.0:compile
| | +- org.apache.tika:tika-parser-font-module:jar:2.3.0:compile
| | | \- org.apache.pdfbox:fontbox:jar:2.0.25:compile
| | +- org.apache.tika:tika-parser-html-module:jar:2.3.0:compile
| | | \- org.apache.tika:tika-parser-html-commons:jar:2.3.0:compile
| | | \- de.l3s.boilerpipe:boilerpipe:jar:1.1.0:compile
| | +- org.apache.tika:tika-parser-image-module:jar:2.3.0:compile
| | +- org.apache.tika:tika-parser-mail-module:jar:2.3.0:compile
| | | \- org.apache.tika:tika-parser-mail-commons:jar:2.3.0:compile
| | | +- org.apache.james:apache-mime4j-core:jar:0.8.4:compile
| | | \- org.apache.james:apache-mime4j-dom:jar:0.8.4:compile
| | +- org.apache.tika:tika-parser-microsoft-module:jar:2.3.0:compile
| | | +- com.pff:java-libpst:jar:0.9.3:compile
| | | +- org.apache.poi:poi-scratchpad:jar:5.2.0:compile
| | | +- org.apache.poi:poi-ooxml:jar:5.2.0:compile
| | | | +- org.apache.poi:poi-ooxml-lite:jar:5.2.0:compile
| | | | +- org.apache.xmlbeans:xmlbeans:jar:5.0.3:compile
| | | | \- com.github.virtuald:curvesapi:jar:1.06:compile
| | | +- commons-logging:commons-logging:jar:1.2:compile
| | | +- com.healthmarketscience.jackcess:jackcess:jar:4.0.1:compile
| | | \- com.healthmarketscience.jackcess:jackcess-encrypt:jar:4.0.1:compile
| | +- org.apache.tika:tika-parser-miscoffice-module:jar:2.3.0:compile
| | | \- org.apache.commons:commons-collections4:jar:4.4:compile
| | +- org.apache.tika:tika-parser-news-module:jar:2.3.0:compile
| | | \- com.rometools:rome:jar:1.18.0:compile
| | | +- com.rometools:rome-utils:jar:1.18.0:compile
| | | \- org.jdom:jdom2:jar:2.0.6.1:compile
| | +- org.apache.tika:tika-parser-ocr-module:jar:2.3.0:compile
| | | \- org.apache.commons:commons-exec:jar:1.3:compile
| | +- org.apache.tika:tika-parser-pdf-module:jar:2.3.0:compile
| | | +- org.apache.pdfbox:pdfbox:jar:2.0.25:compile
| | | +- org.apache.pdfbox:pdfbox-tools:jar:2.0.25:compile
| | | | \- org.apache.pdfbox:pdfbox-debugger:jar:2.0.25:compile
| | | \- org.apache.pdfbox:jempbox:jar:1.8.16:compile
| | +- org.apache.tika:tika-parser-pkg-module:jar:2.3.0:compile
| | | +- org.tukaani:xz:jar:1.9:compile
| | | +- org.brotli:dec:jar:0.1.2:compile
| | | \- com.github.junrar:junrar:jar:7.4.1:compile
| | +- org.apache.tika:tika-parser-text-module:jar:2.3.0:compile
| | | +- com.googlecode.juniversalchardet:juniversalchardet:jar:1.0.3:compile
| | | \- org.apache.commons:commons-csv:jar:1.9.0:compile
| | +- org.apache.tika:tika-parser-xml-module:jar:2.3.0:compile
| | | \- xerces:xercesImpl:jar:2.12.2:compile
| | | \- xml-apis:xml-apis:jar:1.4.01:compile
| | +- org.apache.tika:tika-parser-xmp-commons:jar:2.3.0:compile
| | | \- org.apache.pdfbox:xmpbox:jar:2.0.25:compile
| | +- org.gagravarr:vorbis-java-tika:jar:0.8:compile
| | \- org.gagravarr:vorbis-java-core:jar:0.8:compile
| +- org.apache.logging.log4j:log4j-api:jar:2.17.2:compile
| +- org.slf4j:jcl-over-slf4j:jar:1.7.36:compile
| +- org.openjfx:javafx-base:jar:11.0.2:compile
| | \- org.openjfx:javafx-base:jar:linux:11.0.2:compile
| +- org.openjfx:javafx-graphics:jar:11.0.2:compile
| | \- org.openjfx:javafx-graphics:jar:linux:11.0.2:compile
| +- com.sun.xml.bind:jaxb-impl:jar:2.3.6:compile
| | \- com.sun.activation:jakarta.activation:jar:1.2.2:compile
| +- javax.xml.bind:jaxb-api:jar:2.3.1:compile
| \- org.openjfx:javafx-controls:jar:11.0.2:compile
| \- org.openjfx:javafx-controls:jar:linux:11.0.2:compile
+- org.springframework.boot:spring-boot-starter-security:jar:2.6.4:compile
| +- org.springframework.boot:spring-boot-starter:jar:2.6.4:compile
| | +- org.springframework.boot:spring-boot-starter-logging:jar:2.6.4:compile
| | | +- ch.qos.logback:logback-classic:jar:1.2.10:compile
| | | | \- ch.qos.logback:logback-core:jar:1.2.10:compile
| | | +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.17.2:compile
| | | \- org.slf4j:jul-to-slf4j:jar:1.7.36:compile
| | +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:compile
| | \- org.yaml:snakeyaml:jar:1.29:compile
| +- org.springframework:spring-aop:jar:5.3.16:compile
| | \- org.springframework:spring-beans:jar:5.3.16:compile
| +- org.springframework.security:spring-security-config:jar:5.6.2:compile
| | +- org.springframework.security:spring-security-core:jar:5.6.2:compile
| | | \- org.springframework.security:spring-security-crypto:jar:5.6.2:compile
| | \- org.springframework:spring-context:jar:5.3.16:compile
| \- org.springframework.security:spring-security-web:jar:5.6.2:compile
| \- org.springframework:spring-expression:jar:5.3.16:compile
+- org.springframework.boot:spring-boot-starter-validation:jar:2.6.4:compile
| +- org.apache.tomcat.embed:tomcat-embed-el:jar:9.0.58:compile
| \- org.hibernate.validator:hibernate-validator:jar:6.2.2.Final:compile
| \- jakarta.validation:jakarta.validation-api:jar:2.0.2:compile
+- org.springframework.boot:spring-boot-starter-thymeleaf:jar:2.6.4:compile
| +- org.thymeleaf:thymeleaf-spring5:jar:3.0.15.RELEASE:compile
| \- org.thymeleaf.extras:thymeleaf-extras-java8time:jar:3.0.4.RELEASE:compile
+- nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect:jar:3.0.0:compile
| +- org.codehaus.groovy:groovy:jar:3.0.9:compile
| +- nz.net.ultraq.extensions:groovy-extensions:jar:1.1.0:runtime
| +- nz.net.ultraq.thymeleaf:thymeleaf-expression-processor:jar:3.0.0:runtime
| \- org.thymeleaf:thymeleaf:jar:3.0.15.RELEASE:compile
| +- ognl:ognl:jar:3.1.26:compile
| +- org.attoparser:attoparser:jar:2.0.5.RELEASE:compile
| \- org.unbescape:unbescape:jar:1.1.6.RELEASE:compile
+- org.springframework.boot:spring-boot-starter-web:jar:2.6.4:compile
| +- org.springframework.boot:spring-boot-starter-json:jar:2.6.4:compile
| | +- com.fasterxml.jackson.core:jackson-databind:jar:2.13.1:compile
| | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.13.1:compile
| | | \- com.fasterxml.jackson.core:jackson-core:jar:2.13.1:compile
| | +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.13.1:compile
| | +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.13.1:compile
| | \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.13.1:compile
| +- org.springframework:spring-web:jar:5.3.16:compile
| \- org.springframework:spring-webmvc:jar:5.3.16:compile
+- org.springframework.boot:spring-boot-starter-jetty:jar:2.6.4:compile
| +- jakarta.servlet:jakarta.servlet-api:jar:4.0.4:compile
| +- jakarta.websocket:jakarta.websocket-api:jar:1.1.2:compile
| +- org.eclipse.jetty:jetty-servlets:jar:9.4.45.v20220203:compile
| | +- org.eclipse.jetty:jetty-continuation:jar:9.4.45.v20220203:compile
| | +- org.eclipse.jetty:jetty-http:jar:9.4.45.v20220203:compile
| | +- org.eclipse.jetty:jetty-util:jar:9.4.45.v20220203:compile
| | \- org.eclipse.jetty:jetty-io:jar:9.4.45.v20220203:compile
| +- org.eclipse.jetty:jetty-webapp:jar:9.4.45.v20220203:compile
| | +- org.eclipse.jetty:jetty-xml:jar:9.4.45.v20220203:compile
| | \- org.eclipse.jetty:jetty-servlet:jar:9.4.45.v20220203:compile
| | +- org.eclipse.jetty:jetty-security:jar:9.4.45.v20220203:compile
| | | \- org.eclipse.jetty:jetty-server:jar:9.4.45.v20220203:compile
| | \- org.eclipse.jetty:jetty-util-ajax:jar:9.4.45.v20220203:compile
| +- org.eclipse.jetty.websocket:websocket-server:jar:9.4.45.v20220203:compile
| | +- org.eclipse.jetty.websocket:websocket-common:jar:9.4.45.v20220203:compile
| | | \- org.eclipse.jetty.websocket:websocket-api:jar:9.4.45.v20220203:compile
| | +- org.eclipse.jetty.websocket:websocket-client:jar:9.4.45.v20220203:compile
| | | \- org.eclipse.jetty:jetty-client:jar:9.4.45.v20220203:compile
| | \- org.eclipse.jetty.websocket:websocket-servlet:jar:9.4.45.v20220203:compile
| \- org.eclipse.jetty.websocket:javax-websocket-server-impl:jar:9.4.45.v20220203:compile
| +- org.eclipse.jetty:jetty-annotations:jar:9.4.45.v20220203:compile
| | +- org.eclipse.jetty:jetty-plus:jar:9.4.45.v20220203:compile
| | \- org.ow2.asm:asm-commons:jar:9.2:compile
| | +- org.ow2.asm:asm-tree:jar:9.2:compile
| | \- org.ow2.asm:asm-analysis:jar:9.2:compile
| \- org.eclipse.jetty.websocket:javax-websocket-client-impl:jar:9.4.45.v20220203:compile
+- org.springframework.boot:spring-boot-devtools:jar:2.6.4:runtime
| +- org.springframework.boot:spring-boot:jar:2.6.4:compile
| \- org.springframework.boot:spring-boot-autoconfigure:jar:2.6.4:compile
+- org.springframework.boot:spring-boot-configuration-processor:jar:2.6.4:compile
+- org.springframework.boot:spring-boot-starter-test:jar:2.6.4:test
| +- org.springframework.boot:spring-boot-test:jar:2.6.4:test
| +- org.springframework.boot:spring-boot-test-autoconfigure:jar:2.6.4:test
| +- com.jayway.jsonpath:json-path:jar:2.6.0:test
| | \- net.minidev:json-smart:jar:2.4.8:test
| | \- net.minidev:accessors-smart:jar:2.4.8:test
| +- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.3:compile
| | \- jakarta.activation:jakarta.activation-api:jar:1.2.2:compile
| +- org.assertj:assertj-core:jar:3.21.0:test
| +- org.hamcrest:hamcrest:jar:2.2:test
| +- org.junit.jupiter:junit-jupiter:jar:5.8.2:test
| | +- org.junit.jupiter:junit-jupiter-api:jar:5.8.2:test
| | | \- org.opentest4j:opentest4j:jar:1.2.0:test
| | +- org.junit.jupiter:junit-jupiter-params:jar:5.8.2:test
| | \- org.junit.jupiter:junit-jupiter-engine:jar:5.8.2:test
| +- org.mockito:mockito-core:jar:4.0.0:test
| | +- net.bytebuddy:byte-buddy-agent:jar:1.11.22:test
| | \- org.objenesis:objenesis:jar:3.2:test
| +- org.mockito:mockito-junit-jupiter:jar:4.0.0:test
| +- org.skyscreamer:jsonassert:jar:1.5.0:test
| | \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test
| +- org.springframework:spring-core:jar:5.3.16:compile
| | \- org.springframework:spring-jcl:jar:5.3.16:compile
| +- org.springframework:spring-test:jar:5.3.16:test
| \- org.xmlunit:xmlunit-core:jar:2.8.4:test
+- org.springframework.boot:spring-boot-starter-data-jpa:jar:2.6.4:compile
| +- org.springframework.boot:spring-boot-starter-aop:jar:2.6.4:compile
| | \- org.aspectj:aspectjweaver:jar:1.9.7:compile
| +- org.springframework.boot:spring-boot-starter-jdbc:jar:2.6.4:compile
| | +- com.zaxxer:HikariCP:jar:4.0.3:compile
| | \- org.springframework:spring-jdbc:jar:5.3.16:compile
| +- jakarta.transaction:jakarta.transaction-api:jar:1.3.3:compile
| +- jakarta.persistence:jakarta.persistence-api:jar:2.2.3:compile
| +- org.springframework.data:spring-data-jpa:jar:2.6.2:compile
| | +- org.springframework.data:spring-data-commons:jar:2.6.2:compile
| | +- org.springframework:spring-orm:jar:5.3.16:compile
| | \- org.springframework:spring-tx:jar:5.3.16:compile
| \- org.springframework:spring-aspects:jar:5.3.16:compile
+- org.junit.platform:junit-platform-runner:jar:1.8.1:test
| +- junit:junit:jar:4.13.2:test
| | \- org.hamcrest:hamcrest-core:jar:2.2:test
| +- org.junit.platform:junit-platform-launcher:jar:1.8.2:test
| | \- org.junit.platform:junit-platform-engine:jar:1.8.2:test
| +- org.junit.platform:junit-platform-suite-api:jar:1.8.2:test
| | \- org.junit.platform:junit-platform-commons:jar:1.8.2:test
| +- org.apiguardian:apiguardian-api:jar:1.1.2:test
| \- org.junit.platform:junit-platform-suite-commons:jar:1.8.2:test
+- com.h2database:h2:jar:1.4.197:compile
+- org.springframework.boot:spring-boot-starter-mail:jar:2.6.4:compile
| +- org.springframework:spring-context-support:jar:5.3.16:compile
| \- com.sun.mail:jakarta.mail:jar:1.6.7:compile
\- org.apache.commons:commons-lang3:jar:3.7:compile
Yet I am quite surprised that after this log4j upgrade, when I input the payload provided by https://log4shell.huntress.com/ it still logs an input at their site.
The payload is input in a search bar field on a web page. I also tried to input the payload on the login page of my web site but it did not trigger the writing of an entry at Huntress site.
EDIT (this is an important clue [see my answer]) : Please note that the search bar field triggers a search via SORLJ which requires a SOLR installation on disk. So a version of SOLR was installed on disk and did not change when I removed the older LOG4J version from my program internal libraries.
Can it be that a vulnerable version of log4j is still used somewhere in my project although it does not appear in the dependency tree ? Or does it come from another library (one from the above list) ?
How can I fix this flaw now ?
Any help appreciated.
