Vulnerability Scanner/Detector Log4Shell Remote Code Execution Log4j (CVE-2021–44228) — Ansible log4j-cve-2021–44228

# Red Hat detector: https://access.redhat.com/security/vulnerabilities/RHSB-2021-009
sh_detector: "cve-2021-44228--2021-12-20-1836.sh"
sh_signature: 'cve-2021-44228--2021-12-20-1836.sh.asc'
detector_baseurl: 'https://access.redhat.com/sites/default/files/'
detector_path: "/var/"
detector_dir: "/tmp/cve-2021-44228/"
detector_run_dir: 'tmp'
detector_options: '-n -d --no-progress --scan {{ detector_path }}'
gpg_keyid: '7514F77D8366B0D9'
gpg_public_key: 'gpg --keyserver pgp.mit.edu --recv {{ gpg_keyid }}'
clean_run_before: true
delete_after: false
verify_gpg: true

---
- name: detector for Apache Log4j (CVE-2021-44228)
  hosts: all
  become: true
  tasks:
    - include_vars: vars.yml

    - name: dependency present
      ansible.builtin.package:
        name: unzip
        state: present
        update_cache: true

    - name: create detector directory
      ansible.builtin.file:
        path: '{{ detector_dir }}'
        state: directory

    - name: download detector file(s)
      ansible.builtin.get_url:
        url: "{{ detector_baseurl }}{{ item }}"
        dest: "{{ detector_dir }}{{ item }}"
        mode: '0755'
        owner: root
        group: root
      with_items:
        - '{{ sh_detector }}'
        - '{{ sh_signature }}'

    - name: gpg public key
      ansible.builtin.shell: '{{ gpg_public_key }}'
      when: verify_gpg == true

    - name: gpg verify detector
      ansible.builtin.shell: 'gpg --verify {{ detector_dir }}{{ sh_signature }} {{ detector_dir }}{{ sh_detector }}'
      when: verify_gpg == true

    - name: remove any detector run directory
      ansible.builtin.file:
        path: '{{ detector_dir }}{{ detector_run_dir }}'
        state: absent
      when: clean_run_before == true

    - name: create detector run directory
      ansible.builtin.file:
        path: '{{ detector_dir }}{{ detector_run_dir }}'
        state: directory

    - name: run detector/scanner
      ansible.builtin.shell: '{{ detector_dir }}{{ sh_detector }} {{ detector_options }} --tmp {{ detector_dir }}{{ detector_run_dir }}'

    - name: files in detector run directory
      ansible.builtin.find:
        paths: '{{ detector_dir }}{{ detector_run_dir }}'
      register: vulnerable

    - name: print vulnerable path(s) found
      ansible.builtin.debug:
        var: vulnerable

    - name: remove detector directory
      ansible.builtin.file:
        path: '{{ detector_dir }}'
        state: absent
      when: delete_after == true

PLAY [detector for Apache Log4j (CVE-2021-44228)] ******************************
TASK [Gathering Facts] *********************************************************
ok: [demo]
TASK [include_vars] ************************************************************
ok: [demo]
TASK [dependency present] ******************************************************
ok: [demo]
TASK [create detector directory] ***********************************************
ok: [demo]
TASK [download detector file(s)] ***********************************************
ok: [demo] => (item=cve-2021-44228--2021-12-20-1836.sh)
ok: [demo] => (item=cve-2021-44228--2021-12-20-1836.sh.asc)
TASK [gpg public key] **********************************************************
changed: [demo]
TASK [gpg verify detector] *****************************************************
changed: [demo]
TASK [remove any detector run directory] ***************************************
changed: [demo]
TASK [create detector run directory] *******************************************
changed: [demo]
TASK [run detector/scanner] ****************************************************
changed: [demo]
TASK [files in detector run directory] ************
ok: [demo]
TASK [print vulnerable path(s) found] ******************************************
ok: [demo] => {
    "vulnerable": {
        "changed": false,
        "examined": 1,
        "failed": false,
        "files": [],
        "matched": 0,
        "msg": "All paths examined",
        "skipped_paths": {}
    }
}
TASK [remove detector directory] ***********************************************
skipping: [demo]
PLAY RECAP *********************************************************************
demo                       : ok=12   changed=5    unreachable=0    failed=0    skipped=1    rescued=0    ignored=0

ansible-galaxy install lucab85.ansible_role_log4shell