FlexNet Manager Blog (Archived) — ChrisG (Flexera Software)
All of us who work in the world of IT have been madly scrambling this week to assess where we stand in relation to the recently disclosed CVE-2021-44228 vulnerability in Apache Log4j 2 (widely referred to as Log4Shell). One key question everybody is asking is: how can we detect and identify systems that are potentially vulnerable?
There are many tactics being followed to help answer this question. I’d like to share some suggestions for one tactic that organizations who are using FlexNet Manager Suite On Premises with inventory gathered by the FlexNet inventory agent might consider. This involves:
- Configuring agents to gather details of files with specific names that are of interest.
- Extracting/reporting on gathered details.
I hope these suggestions are useful. What tactics are you using to identify where you might be exposed to Log4Shell? Post ideas in the comments below.
Configuring agents to gather details of files with a specified nameThe FlexNet inventory agent’s IncludeFile preference can be configured to specify names of files whose details should be included when gathering inventory. For example, setting this preference to the value log4j-core-*.jar will include details of files found on the filesystem that match the specified pattern.
Some possible approaches to configure the value of the IncludeFile preference are:
- Arrange to set the value in the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ManageSoft Corp\ManageSoft\Tracker\CurrentVersion\IncludeFile registry entry on each computer running a Windows operating system.
- Arrange to set the value in the /var/opt/managesoft/etc/mgsconfig.ini configuration file on each computer running a UNIX-like operating system. For example, the following shell commands will do this:
- cat >/tmp/tempconfig.ini <<EOF[ManageSoft\Tracker\CurrentVersion]IncludeFile=log4j-core-*.jarEOF/opt/managesoft/bin/mgsconfig -i /tmp/tempconfig.inirm /tmp/tempconfig.ini
- Set the value through agent policy settings. There is no UI to configure this directly, but it can be done with direct manipulation of some details in the compliance database with a SQL script like the following:
- -- The value of @TargetName should be set to one 'Target__windows',-- 'Target__osx' or 'Target__unix' to set policy settings for computers-- running the identified type of operating system.---- To target multiple types of operating systems, change the value and-- re-run this script multiple times.DECLARE @TargetName NVARCHAR(100)SET @TargetName = 'Target__windows' -- or 'Target__osx' or 'Target__unix'-- Ensure the built-in target existsEXEC dbo.BeaconTargetPutByNameInternal @Name = @TargetName, @Internal = 1, @Description = NULL, @Visible = 0-- Get the ID of the target to have settings appliedDECLARE @btid INTSELECT @btid = BeaconTargetIDFROM dbo.BeaconTargetWHERE Name = @TargetName-- Add setting to agent policy for computers covered by the above targetEXEC dbo.BeaconTargetPropertyValuePutByKeyNameBeaconTargetID @KeyName = 'CTrackerIncludeFile', @BeaconTargetID = @btid, @Value = 'log4j-core-*.jar'-- Force beacons to update to get latest settings containing the above changesEXEC dbo.BeaconPolicyUpdateRevision
- If the ndtrack inventory gathering process is invoked directly, specify a value for the preference on the command line. For example:
- ndtrack -t Machine -o IncludeFile=log4j-core-*.jar
Agent settings to scan for file details must be enabled for the IncludeFile preference to be effective. These settings are commonly configured through the Included file evidence configuration settings on the Discovery & Inventory > Settings page in the FlexNet Manager Suite web UI.
Once agent preferences are configured appropriately, details of files will appear in inventory .ndi files similarly to the following:
- <Content MD5="NO_MD5" Size="5427604"> <Instance Path="C:\Path\log4j-core-2.16.0.jar" DateTime="20211212T233542"/></Content>
Reporting on gathered details
Once inventory gathered by agents has been uploaded and imported, appropriately crafted SQL queries can be run against the inventory database to extract and report on details.
For example, the following query will retrieve a list of computer names along with details of files that have been found on them:
- SELECT ComputerName = c.ComputerCN , FileName = sfn.Name, sp.Path, sf.Size, Timestamp = sf.DateTime , InventoryDate = ir.SWDateFROM dbo.SoftwareFileName sfn JOIN dbo.SoftwareFile sf ON sf.SoftwareFileNameID = sfn.SoftwareFileNameID JOIN dbo.SoftwareFilePath sp ON sp.SoftwareFilePathID = sf.SoftwareFilePathID JOIN dbo.Computer c ON c.ComputerID = sf.ComputerID JOIN dbo.InventoryReport ir ON ir.ComputerID = sf.ComputerIDWHERE sfn.Name LIKE 'log4j-core-%.jar'
While knowing which computers files are found on can be useful to gain insight into possible exposure to a vulnerability like Log4Shell, it is far from bulletproof:
- Having a file with a particular name installed does not guarantee that a system is exposed or vulnerable.
- Conversely, failing to find a file with a particular name installed does not guarantee that a system is not exposed or vulnerable.
A tactic of looking for files with particular names like this should be just one of many tactics that an organization uses.
Possible extensionsIdeas for possible additional extensions to the above approach which you might consider are:
- Import additional file details as file evidence into Flexnet Manager Suite
By default, FlexNet Manager Suite’s inventory import procedures only import details of files that end with one of the following extensions: .sys, sys2, wtag, dtag, ptag, .sig, .exe, and .lax
Advanced FlexNet Manager Suite administrators could explore modifying the inventory import procedures to import details of files with additional extensions of interest. - Reporting interface
Rather than extracting data from the inventory database with a direct query, consider using reporting tools that can provide this data through an appropriate user interface.
If you’re interested in this topic, here are some other links that may be useful:
- Log4j vulnerability - info on how to scan and question about how to determine version on results (FlexNet Manager forum discussion)
- Identifying Apache Log4j JNDI Vulnerability “Log4Shell” (CVE-2021-44228, CVE-2021-4104) (another FlexNet Manager blog post)
Thanks to the following Flexera Community users for sharing questions, ideas and discussion that have helped to inspire this post: @Frank07 , @bmaudlin , @adrian_ritz1 , @dennis_reinhardt , @akuntze , @WStephans , @caipingcba , @raghuvaran_ram , @Resnofendri
Very nice summary! Is there any reason for the specification of "log4j-core-%.jar" instead of "log4j%.jar" or was that just an example?
Because I scanned just for the jar extention and the results, after filtering on both options differ both in the quantity of files and in the number of devices on which something was found. Looking at the CVE article I think "-core" was just used as an example.
"log4j-core-%.jar" is just an example. I used 'log4j*.jar' with solution 1 and it worked and collected all log4*.jar files.
I have a question about roll back.
What is the roll back procedure for point 3. Set the value through agent policy settings?
I assume the rollback step is just to remove new rows in DB table dbo.BeaconTargetPropertyValue
@caipingcba
Even tho not available in the WebUI you can configure "custom parameters" withing the database. This information is then published in the BeaconConfig.xml. With the configuration update the agents then retrieve this information.In the case of the example a a registry key (windows) will be written as
"CTrackerIncludeFile" with the Value "log4j-core-*.jar"
This will lead to the same result as all the other options. It just has little manual effort, since the agents update themself with the new config.
This also works for UX based agents. The information is just stored in the config file, since there is no registry.
@old_mkieselbach - the techniques described here can certainly be applied to different filename patterns. I chose log4j-core-*.jar as the example as that will match common filenames that contain the CVE-2021-44228 vulnerability. You will find many more files match the more general pattern log4j*.jar, but most of them are not going to be related to the vulnerability.
FWIW, some information about the specific JAR file impacted by the vulnerability appears on the page at https://logging.apache.org/log4j/2.x/security.html which states:
"Note that only the log4j-core JAR file is impacted by this vulnerability."
With all of that said, and to elaborate on an important comment made in this post: the vulnerability may exist in files with different names, including files that have no obvious relationship to log4j. For example, the log4j-core JAR file could easily be embedded in a file named HappyDays.war, which a simple scan of the filesystem for files named log4j-core-*.jar won't find.
@caipingcba - to rollback changes that were made to the agent policy settings using the SQL script described in this post:
@ChrisG I followed step 3 and the only changes I made in the query was the target name (created target name under discovery and inventory rules and selected the servers) when executed our DB showed successful results as 3 rows were affected. I waited for the full reconciliation and one day for the agents to collect the new inventory and then ran the query you mentioned under this topic "Reporting on gathered details"
when I executed that query it did not provide any output. please help me to understand what I'm doing wrong.
I want to scan all my servers to find the files and path anything in this name 'log4j-core-%.jar'
also when I exected this command in the compliance DB
selects FROM dbo.BeaconTargetPropertyValue
WHERE KeyName = 'CTrackerIncludeFile'it showed 3 results as I created 3 targets each for Windows, Linux & Unix.
@raghuvaran_ram - there are a lot of moving parts between the start and end of the process you've described here, so it is hard to guess what may have been missed. Here are some ideas of places to look to see if you can spot where things may have broken down.
Select a problematic client computer for troubleshooting. A good starting point on that computer is then to check the ndtrack component's log file to ensure it shows file details being gathered as part of inventory. This file is at C:\Windows\Temp\ManageSoft\tracker.log on Windows, or /var/opt/managesoft/log/tracker.log UNIX-like operating systems.
Key messages to look for in the log file are:
If you don't find all of these messages in the file it suggests that the agent's preference settings were not set appropriately to gather the data you're looking for at the time inventory was last gathered. For example, maybe policy has not been applied since the settings were updated on the server, or maybe the policy settings to enable gathering of file details were not configured as you expected.
Some other files to check on the client computer are:
Note that the approach described in this article does not depend on the reconciliation process having run. Data will be returned by the final "SELECT" SQL query executed against the inventory database as soon as inventory NDI files are uploaded and imported into the inventory database.
Thanks for shring the details @ChrisG , We are using FNMS Cloud not on premises so is it still a concern because we are capturing invnetory through Inventory agent?