Ansible Pilot

Vulnerability Scanner/Detector Log4Shell Remote Code Execution Log4j (CVE-2021–44228) — Ansible log4j-cve-2021–44228

How to automate the Vulnerability Scanner/Detector provided by Red Hat RHSB-2021–009 Log4Shell — Remote Code Execution — log4j (CVE-2021–44228) with Ansible Playbook. Installation of dependency, GPG key verification, Vulnerability Scanner/Detector run, and result display on target Linux machine.

How to automate the Detector Log4Shell Remote Code Execution Log4j (CVE-2021–44228)?

I’m going to show you a live demo with some simple Ansible code. I’m Luca Berton and welcome to today’s episode of Ansible Pilot.

Log4Shell Remote Code Execution Log4j (CVE-2021–44228)

Remember 2014? Heartbleed was a bug in OpenSSL, the most popular open-source code library for Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols usage in encrypting websites and software. At the time the flaw allowed to read confidential information allowing the hackers to trick a vulnerable web server with encryption keys. Back to the present! Log4j - the Java program compromised by the Log4Shell bug - is a widely used, multi-platform open-source Java logging framework library developed and maintained under the volunteer Apache Software Foundation. Log4j is widely used on servers to record users' activities to analyze later by security or development teams. Hackers could use the Log4Shell flaw to access sensitive information on a variety of devices, plant ransomware attacks, and take over machines to mine cryptocurrencies. The vulnerability was discovered almost by happenstance when Microsoft announced it had found suspicious activity in Minecraft: Java Edition, a popular video game it owns. The flaw was officially founded by Chen Zhaojun of Alibaba’s Cloud Security Team on the 24th of November 2021. Some estimation to Wiz and EY, the vulnerability affected 93% of enterprise cloud environments. Affected commercial services include Amazon Web Services, Cloudflare, iCloud, Minecraft: Java Edition, Steam, Tencent QQ, and many others.

Red Hat detector

version 1.2 release 2021-12-20

version 1.3 release 2022-01-10


A real-life demo of how to automate the Red Hat Detector Log4Shell Remote Code Execution Log4j (CVE-2021–44228) on Linux with Ansible playbook.


# Red Hat detector:
sh_detector: ""
sh_signature: ''
detector_baseurl: ''
detector_path: "/var/"
detector_dir: "/tmp/cve-2021-44228/"
detector_run_dir: 'tmp'
detector_options: '-n -d --no-progress --scan {{ detector_path }}'
gpg_keyid: '7514F77D8366B0D9'
gpg_public_key: 'gpg --keyserver --recv {{ gpg_keyid }}'
clean_run_before: true
delete_after: false
verify_gpg: true

- name: detector for Apache Log4j (CVE-2021-44228)
  hosts: all
  become: true
    - include_vars: vars.yml    - name: dependency present
        name: unzip
        state: present
        update_cache: true    - name: create detector directory
        path: '{{ detector_dir }}'
        state: directory    - name: download detector file(s)
        url: "{{ detector_baseurl }}{{ item }}"
        dest: "{{ detector_dir }}{{ item }}"
        mode: '0755'
        owner: root
        group: root
        - '{{ sh_detector }}'
        - '{{ sh_signature }}'    - name: gpg public key '{{ gpg_public_key }}'
      when: verify_gpg == true    - name: gpg verify detector 'gpg --verify {{ detector_dir }}{{ sh_signature }} {{ detector_dir }}{{ sh_detector }}'
      when: verify_gpg == true    - name: remove any detector run directory
        path: '{{ detector_dir }}{{ detector_run_dir }}'
        state: absent
      when: clean_run_before == true    - name: create detector run directory
        path: '{{ detector_dir }}{{ detector_run_dir }}'
        state: directory    - name: run detector/scanner '{{ detector_dir }}{{ sh_detector }} {{ detector_options }} --tmp {{ detector_dir }}{{ detector_run_dir }}'    - name: files in detector run directory
        paths: '{{ detector_dir }}{{ detector_run_dir }}'
      register: vulnerable    - name: print vulnerable path(s) found
        var: vulnerable    - name: remove detector directory
        path: '{{ detector_dir }}'
        state: absent
      when: delete_after == true

code with ❤️ in GitHub


PLAY [detector for Apache Log4j (CVE-2021-44228)] ******************************
TASK [Gathering Facts] *********************************************************
ok: [demo]
TASK [include_vars] ************************************************************
ok: [demo]
TASK [dependency present] ******************************************************
ok: [demo]
TASK [create detector directory] ***********************************************
ok: [demo]
TASK [download detector file(s)] ***********************************************
ok: [demo] => (
ok: [demo] => (
TASK [gpg public key] **********************************************************
changed: [demo]
TASK [gpg verify detector] *****************************************************
changed: [demo]
TASK [remove any detector run directory] ***************************************
changed: [demo]
TASK [create detector run directory] *******************************************
changed: [demo]
TASK [run detector/scanner] ****************************************************
changed: [demo]
TASK [files in detector run directory] ************
ok: [demo]
TASK [print vulnerable path(s) found] ******************************************
ok: [demo] => {
    "vulnerable": {
        "changed": false,
        "examined": 1,
        "failed": false,
        "files": [],
        "matched": 0,
        "msg": "All paths examined",
        "skipped_paths": {}
TASK [remove detector directory] ***********************************************
skipping: [demo]
PLAY RECAP *********************************************************************
demo                       : ok=12   changed=5    unreachable=0    failed=0    skipped=1    rescued=0    ignored=0

Ansible Galaxy role

Code also available as Ansible Galaxy role lucab85.ansible_role_log4shell:

ansible-galaxy install lucab85.ansible_role_log4shell


Now you know how to automate the Detector Log4Shell Remote Code Execution Log4j (CVE-2021–44228) on Linux with Ansible. Subscribe to the YouTube channel, Medium, Website and Twitter to not miss the next episode of the Ansible Pilot.


Learn the Ansible automation technology with some real-life examples in my

Want to keep this project going? Please donate

Follow me

Subscribe not to miss any new releases

December 22, 2021

FREE Top 10 Best Practices

Top 10 Best Practices of Ansible Automation: save time, reduce errors and stress