Log4jDeepScanAction: Automated Log4j Vulnerability Scanner

• Log4jDeepScanAction is a GitHub Action that automates the detection and remediation of Log4j vulnerabilities through configuration and deep code scans.
• It employs a two-phase scanning approach by mapping detected vulnerabilities to CVE identifiers and computing CVSS Base Scores to prioritize risks.
• Seamlessly integrated into CI pipelines, it provides real-time remediation guidance with automated pull request annotations and detailed vulnerability reports.

Log4jDeepScanAction is a GitHub Action designed for advanced detection and mitigation of exploitable Log4j vulnerabilities in open-source projects using automated and continuous scanning. Unlike prior tools that focus on library version identification, Log4jDeepScanAction is engineered to assess real-world exploitability by verifying the presence of actionable, CVE-related classes or configurations within the codebase, thereby minimizing false positives and providing instant remediation guidance. The action is structured to integrate seamlessly with CI pipelines and development workflows, continuously monitoring as code evolves and automating the processes of vulnerability identification, ranking, and reporting (Wen et al., 1 Jan 2026).

1. Architecture and Workflow

Log4jDeepScanAction orchestrates three logical components in a unified GitHub Actions "job":

• SCANNER: Executes both an initial configuration-file check for Log4j dependency versions and a source code deep scan for patterns linked to known CVEs.
• VULN ANALYZER: Processes findings from the scanner, maps them to CVE identifiers, computes their CVSS Base Score, and ranks them by severity.
• REPORTER: Outputs findings in both machine-readable and human-readable formats, annotates pull requests or push statuses, and posts actionable remediation to developers.

A typical workflow integration is defined in .github/workflows/log4j-deep-scan.yml and includes steps for repository checkout, execution of Log4jDeepScanAction with customizable directory and severity threshold, and result posting to pull requests utilizing actions/github-script@v6. No extra environment variables are required; authentication uses $GITHUB_TOKEN by default.

2. Vulnerability Detection Algorithm

Vulnerability detection in Log4jDeepScanAction proceeds in two phases:

A. Initial Scan (Configuration-file check):

• Parses pom.xml or build.gradle to list dependencies.
• Extracts artifactId and version. If artifactId contains "log4j" and version matches the vulnerable ranges (v1.*, or v2.0–v2.17.2 except for specific patched backports), the dependency is flagged as potentially vulnerable.
• If no configuration file is found or parsing fails, the process proceeds to a deep scan.

B. Deep Scan (Code-pattern check):

• Recursively scans all non-configuration files under the source directory.
• Searches for the presence of classes/constructs tied to specific CVEs, including:
  • org.apache.logging.log4j.core.lookup.JndiLookup (CVE-2021-44228, CVE-2021-45046)
  • org.apache.log4j.net.SocketServer (CVE-2019-17571)
  • org.apache.log4j.net.SMTPAppender (CVE-2020-9488)
  • org.apache.log4j.net.JMSAppender (CVE-2021-4104)
  • org.apache.log4j.net.JMSSink (CVE-2022-23302)
  • org.apache.log4j.jdbc.JDBCAppender (CVE-2022-23305)

The detection does not compute a unique exploitability metric outside of the standard CVSS Base Score, where Base Score = ⌈Impact + Exploitability⌉ (Wen et al., 1 Jan 2026).

3. False-Positive Reduction Strategies

Log4jDeepScanAction employs multiple measures to reduce false positives:

• Flags only when CVE-associated classes or configuration features are actually found in active code or settings (not simply present by dependency).
• Ignores references if code is commented, imports are unused, or configurations are inert.
• Recognizes default safe patches (e.g., JndiLookup disabled by default from v2.16.0 onwards) and does not report unless manual re-enabling is detected.

In project validation, 0 false negatives and 7 false positives (5% of 140 scans) were observed; false positives mainly arose from obsolete Log4j v1 artifacts or inactive optional dependencies.

4. Remediation and Reporting

Upon identifying vulnerabilities, Log4jDeepScanAction:

• Ranks detected issues by CVSS Base Score.
• Generates tabular and human-readable reports in CI build logs and as pull request comments.
• Issues actionable remediation steps per CVE, for example:
  • For CVE-2021-44228: Upgrade to Log4j 2.17.1 or later, or set -Dlog4j2.formatMsgNoLookups=true or remove JndiLookup from the classpath.
  • For CVE-2019-17571: Upgrade to Log4j 2.8.2 or later, or delete SocketServer.class from the deployed JAR.
  • For CVE-2020-9488: Upgrade to Log4j 2.13.2 or later, or set mail.smtp.ssl.checkserveridentity=true in SMTP appender configuration.

Reporting is automated and can annotate pull requests directly via GitHub APIs.

5. Integration into Continuous Development Workflows

The action is configured through a YAML workflow file, allowing the following customization:

• scan-directory: Directory to analyze (default: root).
• severity-threshold: Minimal CVSS score considered a failure (default: 0.0).

Trigger events include pushes to the main branch and pull request submissions. Failed scans can block merges if branch protection rules are enabled, thereby enforcing security as an integral part of the CI process. All findings and remediation advice are provided in real time as part of the development feedback cycle.

6. Empirical Evaluation and Performance Metrics

The tool was evaluated on 28 open-source projects, spanning over 100,000 LOC in 21 projects, with 5 releases per project, yielding 140 scans in total. Ground truth was verified through official release notes, CVE databases, and manual inspection.

Results:

• Correct classifications: 128/140 (accuracy 91.4%)
• False positives: 7 (5%), largely due to unused or optional Log4j v1 code
• False negatives: 0
• Mis-labeled CVEs: 5 cases (correct detection but incorrect CVE annotation)

Notable CVE findings:

• CVE-2021-44228 ("Log4Shell") – CVSS 10.0 – detected in 50/140 scans
• CVE-2022-23307 – CVSS 10.0 – detected in 15/140 scans
• CVE-2021-45046 – CVSS 9.0 – detected in 54/140 scans
• CVE-2022-23302 – CVSS 9.0 – frequency in study provided in source (Wen et al., 1 Jan 2026)

7. Installation and Usage

Log4jDeepScanAction is available on the GitHub Marketplace. Installation involves:

1. Adding or modifying .github/workflows/log4j-scan.yml with the provided workflow template.
2. Specifying relevant inputs (scan-directory, severity-threshold), if needed.
3. Committing/pushing the workflow file. Detection, scoring, mitigation reporting, and enforcement occur automatically on subsequent pushes or pull requests.

Summary Table: Key Features and Detection Flow

Component	Function	Example Output
SCANNER	Initial config-file & deep code scan	List of vulnerabilities by class/pattern
VULN ANALYZER	CVE mapping, CVSS computation, severity	CVE-2021-44228 : CVSS 10.0; rank=critical
REPORTER	Report formatting, remediation guidance	GitHub PR comment with fix recommendations

Using Log4jDeepScanAction ensures ongoing, automated detection and actionable remediation for exploitable Log4j vulnerabilities in open-source software managed via GitHub workflows (Wen et al., 1 Jan 2026).