How to find log4j vulnerable dependencies quickly across your codebase
Tags: security, programming, computerscience, devops
Published: 2021-12-14 19:59:57

To quickly determine which of your projects depend on the vulnerable versions of log4j, run these queries on Sourcegraph:

### Gradle

```
org\.apache\.logging\.log4j' 2\.((0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15)(\.[0-9]+))
lang:gradle patterntype:regexp count:all
```

**Search Query:** [Gradle](https://sourcegraph.com/search?q=context:global+lang:gradle+org%5C.apache%5C.logging%5C.log4j%5B%27%22%5D+2%5C.%280%7C1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7C10%7C11%7C12%7C13%7C14%7C15%29%28%5C.%5B0-9%5D%2B%29&patternType=regexp) 

### Mavin

```
<log4j\.version>2\.((0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15)(\.[0-9]+))</log4j\.version>
file:pom\.xml patterntype:regexp count:all
```

**Search Query:** [Mavin](https://sourcegraph.com/search?q=context:global+file:pom.xml+%3Clog4j%5C.version%3E2%5C.%280%7C1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7C10%7C11%7C12%7C13%7C14%7C15%29%28%5C.%5B0-9%5D%2B%29%3C/log4j%5C.version%3E&patternType=regexp) 

### Ivy

```
org="org\.apache\.logging\.log4j".*rev="2\.((0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15)(\.[0-9]+))"
file:ivy\.xml patterntype:regexp count:all
```

**Search Query:** [Ivy](https://sourcegraph.com/search?q=context:global+file:ivy.xml+org%3D%22org%5C.apache%5C.logging%5C.log4j%22+rev%3D%222%5C.%280%7C1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7C10%7C11%7C12%7C13%7C14%7C15%29%28%5C.%5B0-9%5D%2B%29%22&patternType=regexp) 


### SBT(Scala)

```
org.apache.logging.log4j" % "2.((0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15)(\.[0-9]+))
file:\.sbt$ patterntype:regexp count:all
```

**Search Query:** [Scala](https://sourcegraph.com/search?q=context:global+file:%5C.sbt%24+%22org.apache.logging.log4j%22+%25+%222%5C.%280%7C1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7C10%7C11%7C12%7C13%7C14%7C15%29%28%5C.%5B0-9%5D%2B%29&patternType=regexp) 

### Bazel

```
org\.apache\.logging\.log4j: 2.((0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15)(\.[0-9]+))
lang:bazel patterntype:regexp count:all
```

**Search Query:** [Bazel](https://sourcegraph.com/search?q=context:global+lang:bazel+org%5C.apache%5C.logging%5C.log4j:+2%5C.%280%7C1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7C10%7C11%7C12%7C13%7C14%7C15%29%28%5C.%5B0-9%5D%2B%29&patternType=regexp) 

### Any file containing org.apache.logging.log4j followed by a vulnerable version number

```
org\.apache\.logging\.log4j 2.((0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15)(\.[0-9]+))
patterntype:regexp count:all
```

**Search Query:** [Any file containing org.apache.logging.log4j followed by a vulnerable version number](https://sourcegraph.com/search?q=context:global+org%5C.apache%5C.logging%5C.log4j+2%5C.%280%7C1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7C10%7C11%7C12%7C13%7C14%7C15%29%28%5C.%5B0-9%5D%2B%29&patternType=regexp) 


### Search your organization’s private code

On [Sourcegraph Cloud](https://sourcegraph.com), run the queries linked above in your user search context **(context:@username)**, after you’ve synced all of the org repositories you want to search **(in Settings > Account > Your repositories)**.

On a [self-hosted Sourcegraph instance](https://docs.sourcegraph.com/?_ga=2.15375984.777352015.1639448382-1702082279.1639448382&_gac=1.153587914.1636895801.Cj0KCQiAhMOMBhDhARIsAPVml-GU6W22T_XZ_khgKhGR4BWZj1Bq85dwPR4AfI1Ju6PKl17Dt7qWnc0aAihpEALw_wcB#quick-install), copy and paste those queries above into the search box on your instance. After pasting, ensure the .* (regexp search) button is on for queries that contain regular expressions.

## In-depth Log4j 0-day fixes and mitigations 

For in-depth info on Log4j Log4Shell 0-day, check out this [excellent article on finding, fixing, and track affected codebase.](https://about.sourcegraph.com/blog/log4j-log4shell-0-day/?utm_medium=social&utm_source=twitter&utm_campaign=blog)

## Conclusion

Finding and fixing vulnerabilities in your codebase can be challenging, but with the right tools, you can speed up the process and secure your codebase in minimal time.


---

Have suggestions or questions? Leave a comment, or join our [Community Slack Space](https://about.sourcegraph.com/community/?utm_medium=social&utm_source=devto&utm_campaign=slacklaunch) where our team will be happy to answer any questions you may have about Sourcegraph.