CERTCC / CVE-2021-44228_scanner

Scanners for Jar files that may be vulnerable to CVE-2021-44228
BSD 2-Clause "Simplified" License
344 stars 89 forks source link

PowerShell script finds nothing if access denied error occurs #5

Closed endnil closed 2 years ago

endnil commented 2 years ago

As described in this reddit thread, Get-ChildItem can return nothing when an "Access is denied" error (System.UnauthorizedAccessException) occurs, despite -ErrorAction Ignore. I found that this happened on some systems when scanning a whole drive from the root directory.

The solution suggested by OPconfused, i.e. building the list of files manually, worked in my case. The "Access is denied" error is still shown, but the script proceeds to check the files that are found.

$jars = @();
Get-ChildItem -Path $topdir -File -Recurse -Force -Include "*.jar","*.war","*.ear","*.zip" -ErrorAction Ignore | % { $jars += $_ };
jsmartbnl commented 2 years ago

Have you guys considered any methods other than GCI for locating target files?

This is exactly why support for pipeline input was added in #25.

no-identd commented 2 years ago

Hmmm even so I find this… oh wait, can we invoke GCI like /ZB in robocopy?

no-identd commented 2 years ago

Also I'd wanna know how this behaves on the magic lab triplet twins aka two DCs two Clients two Servers domain joined/not domain joined & across powershell versions. And consumer (Pro can be domain joined.) vs corporate windows, but at that point we'd be talking full blown model office so that doesn't work.

And with MSRC security baselines applied 🆚 without i.e. Vanilla & out of the box. A lab domain, not your corporate domain.

(this is basically what MS would ask at this point unless you got to a dev immediately, along with the procmon capture. Then you'd have to convince them that they should olease run it in their own labs instead.)

no-identd commented 2 years ago

@tdoan1 actually you might want to use /ZB and/or /EFSRAW. I forgot whether EFS encrypts directory names