The open-sourced scanner was derived from scanners built by members across the open source community, CISA reports.
The Cybersecurity and Infrastructure Security Agency (CISA) has released an open source scanner that businesses can use to find Web services vulnerable to Log4j remote code execution vulnerabilities CVE-2021-44228 and CVE-2021-45046.
"Log4j-scanner is a project derived from other members of the open-source community by CISA to help organizations identify potentially vulnerable web services affected by log4j vulnerabilities," CISA officials wrote on GitHub.
The information and code in the repository were provided "as is," assembled with help from the open source community, and updated by CISA through a collaboration with the broader security community, they noted.
Officials noted there are likely more, still unknown ways to use the Log4j vulnerabilities and that CISA is monitoring multiple platforms to stay up to date as the situation evolves.
In a tweet posted Dec. 21, Secretary Alejandro Mayorkas reported the Log4j vulnerability will also be included in the scope of the new "Hack DHS" bug bounty program announced Dec. 15. The program will include additional incentives to find and patch Log4j-related flaws in DHS systems, Mayorkas wrote.
Check out the CISA scanner on GitHub.
About the Author(s)
You May Also Like
The fuel in the new AI race: Data
April 23, 2024Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024