---

- hosts: all

vars:

responsible_class: JndiLookup.class

pre_tasks:

- name: Check if filename has been provided

ansible.builtin.fail:

msg: "Provide filename to save result in local_file var"

any_errors_fatal: yes

when: local_file is undefined

run_once: yes

- name: Create CSV line and header

ansible.builtin.lineinfile:

path: "{{ local_file }}"

line: "hostname,vulnerable_file"

insertbefore: BOF

create: yes

delegate_to: localhost

run_once: yes

tasks:

- name: Find vulnerable files in remote system

block:

- name: Find directories where the search is to be performed

ansible.builtin.find:

file_type: directory

paths:

- "/"

recurse: no

excludes:

- "proc"

- "dev"

- "boot"

register: root_dirs

- debug:

var: root_dirs.files

- name: Find .jar files

ansible.builtin.find:

file_type: file

paths: "{{ root_dirs.files | map(attribute='path') }}"

recurse: yes

patterns:

- "*.jar"

register: jar_files

- name: Search JndiLookup.class in .jar files

ansible.builtin.shell:

cmd: "grep -i {{ responsible_class }} {{ jar_files.files | map(attribute='path') | join(' ') }}"

register: grep_result

failed_when: grep_result.rc == 2

when: jar_files.matched > 0

become: yes

post_tasks:

- name: Write CSV line with affected values

ansible.builtin.lineinfile:

path: "{{ local_file }}"

line: "{{ inventory_hostname }},{{ item | regex_search('/.*\\.jar') }}"

insertafter: EOF

loop: "{{ grep_result.stdout_lines }}"

when: grep_result.rc is defined and grep_result.rc == 0

delegate_to: localhost