A Comparative Study of Log4Sheil Test Tools

Log4Shell was a critical Remote Code Execution vulnerability publicly disclosed on December 10th, 2021. Given its potential to be found in any Java application, organizations around the globe were scrambling to determine their exposure as well as identify methods to eliminate their exposure where possible and mitigate the risk elsewhere. This led to security teams needing tools to check for the vulnerability, assess fixes and mitigations, and demonstrate the vulnerability's impact in their environment. Both open-source and vendor communities were quick to deliver a wide variety of tools. In this paper we present a taxonomy and an analysis of 18 Log4Shell test tools spanning dynamic analysis, static analysis, honeypot, etc. As expected, dynamic tools could demonstrate exploitability while static tools provided more certainty. Most importantly, our analysis showed that understanding how each tool interprets the attack surface of the test item has a profound effect on the results and how they should be interpreted.