---
title: 'Log4jDeepScanAction: Automated Log4j Vulnerability Scanner'
url: https://www.emergentmind.com/topics/log4jdeepscanaction
type: topic
---

# Log4jDeepScanAction: Automated Log4j Vulnerability Scanner

Log4jDeepScanAction is a GitHub Action designed for advanced detection and mitigation of exploitable Log4j vulnerabilities in open-source projects using automated and continuous scanning. Unlike prior tools that focus on library version identification, Log4jDeepScanAction is engineered to assess real-world exploitability by verifying the presence of actionable, CVE-related classes or configurations within the codebase, thereby minimizing false positives and providing instant remediation guidance. The action is structured to integrate seamlessly with CI pipelines and development workflows, continuously monitoring as code evolves and automating the processes of vulnerability identification, ranking, and reporting [2601.00235].

## 1. Architecture and Workflow

Log4jDeepScanAction orchestrates three logical components in a unified GitHub Actions "job":

- **SCANNER**: Executes both an initial configuration-file check for Log4j dependency versions and a source code deep scan for patterns linked to known CVEs.
- **VULN ANALYZER**: Processes findings from the scanner, maps them to CVE identifiers, computes their CVSS Base Score, and ranks them by severity.
- **REPORTER**: Outputs findings in both machine-readable and human-readable formats, annotates pull requests or push statuses, and posts actionable remediation to developers.

A typical workflow integration is defined in `.github/workflows/log4j-deep-scan.yml` and includes steps for repository checkout, execution of Log4jDeepScanAction with customizable directory and severity threshold, and result posting to pull requests utilizing `actions/github-script@v6`. No extra environment variables are required; authentication uses `$GITHUB_TOKEN` by default.

## 2. Vulnerability Detection Algorithm

Vulnerability detection in Log4jDeepScanAction proceeds in two phases:

**A. Initial Scan (Configuration-file check):**
- Parses `pom.xml` or `build.gradle` to list dependencies.
- Extracts `artifactId` and version. If `artifactId` contains "log4j" and version matches the vulnerable ranges (v1.*, or v2.0–v2.17.2 except for specific patched backports), the dependency is flagged as potentially vulnerable.
- If no configuration file is found or parsing fails, the process proceeds to a deep scan.

**B. Deep Scan (Code-pattern check):**
- Recursively scans all non-configuration files under the source directory.
- Searches for the presence of classes/constructs tied to specific CVEs, including:
  - `org.apache.logging.log4j.core.lookup.JndiLookup` (CVE-2021-44228, CVE-2021-45046)
  - `org.apache.log4j.net.SocketServer` (CVE-2019-17571)
  - `org.apache.log4j.net.SMTPAppender` (CVE-2020-9488)
  - `org.apache.log4j.net.JMSAppender` (CVE-2021-4104)
  - `org.apache.log4j.net.JMSSink` (CVE-2022-23302)
  - `org.apache.log4j.jdbc.JDBCAppender` (CVE-2022-23305)

The detection does not compute a unique exploitability metric outside of the standard CVSS Base Score, where Base Score = ⌈Impact + Exploitability⌉ [2601.00235].

## 3. False-Positive Reduction Strategies

Log4jDeepScanAction employs multiple measures to reduce false positives:
- Flags only when CVE-associated classes or configuration features are actually found in active code or settings (not simply present by dependency).
- Ignores references if code is commented, imports are unused, or configurations are inert.
- Recognizes default safe patches (e.g., JndiLookup disabled by default from v2.16.0 onwards) and does not report unless manual re-enabling is detected.

In project validation, 0 false negatives and 7 false positives (5% of 140 scans) were observed; false positives mainly arose from obsolete Log4j v1 artifacts or inactive optional dependencies.

## 4. Remediation and Reporting

Upon identifying vulnerabilities, Log4jDeepScanAction:
- Ranks detected issues by CVSS Base Score.
- Generates tabular and human-readable reports in CI build logs and as pull request comments.
- Issues actionable remediation steps per CVE, for example:
  - For CVE-2021-44228: Upgrade to Log4j 2.17.1 or later, or set `-Dlog4j2.formatMsgNoLookups=true` or remove `JndiLookup` from the classpath.
  - For CVE-2019-17571: Upgrade to Log4j 2.8.2 or later, or delete `SocketServer.class` from the deployed JAR.
  - For CVE-2020-9488: Upgrade to Log4j 2.13.2 or later, or set `mail.smtp.ssl.checkserveridentity=true` in SMTP appender configuration.

Reporting is automated and can annotate pull requests directly via GitHub APIs.

## 5. Integration into Continuous Development Workflows

The action is configured through a YAML workflow file,
allowing the following customization:
- `scan-directory`: Directory to analyze (default: root).
- `severity-threshold`: Minimal CVSS score considered a failure (default: 0.0).

Trigger events include pushes to the main branch and pull request submissions. Failed scans can block merges if branch protection rules are enabled, thereby enforcing security as an integral part of the CI process. All findings and remediation advice are provided in real time as part of the development feedback cycle.

## 6. Empirical Evaluation and Performance Metrics

The tool was evaluated on 28 open-source projects, spanning over 100,000 LOC in 21 projects, with 5 releases per project, yielding 140 scans in total. Ground truth was verified through official release notes, CVE databases, and manual inspection.

**Results:**
- Correct classifications: 128/140 (accuracy 91.4%)
- False positives: 7 (5%), largely due to unused or optional Log4j v1 code
- False negatives: 0
- Mis-labeled CVEs: 5 cases (correct detection but incorrect CVE annotation)

Notable CVE findings:
- CVE-2021-44228 ("Log4Shell") – CVSS 10.0 – detected in 50/140 scans
- CVE-2022-23307 – CVSS 10.0 – detected in 15/140 scans
- CVE-2021-45046 – CVSS 9.0 – detected in 54/140 scans
- CVE-2022-23302 – CVSS 9.0 – frequency in study provided in source [2601.00235]

## 7. Installation and Usage

Log4jDeepScanAction is available on the GitHub Marketplace. Installation involves:
1. Adding or modifying `.github/workflows/log4j-scan.yml` with the provided workflow template.
2. Specifying relevant inputs (`scan-directory`, `severity-threshold`), if needed.
3. Committing/pushing the workflow file. Detection, scoring, mitigation reporting, and enforcement occur automatically on subsequent pushes or pull requests.

**Summary Table: Key Features and Detection Flow**

| Component        | Function                                    | Example Output                                   |
|------------------|---------------------------------------------|--------------------------------------------------|
| SCANNER          | Initial config-file & deep code scan        | List of vulnerabilities by class/pattern         |
| VULN ANALYZER    | CVE mapping, CVSS computation, severity     | CVE-2021-44228 : CVSS 10.0; rank=critical        |
| REPORTER         | Report formatting, remediation guidance     | GitHub PR comment with fix recommendations       |

Using Log4jDeepScanAction ensures ongoing, automated detection and actionable remediation for exploitable Log4j vulnerabilities in open-source software managed via GitHub workflows [2601.00235].

Source: https://www.emergentmind.com/topics/log4jdeepscanaction