# JNDI lookup injection via attacker strings

User-controlled strings reaching JNDI lookups, JAAS configs, or loggers that resolve ${jndi:} expressions

_Area: Web injection and code execution. Seen in 3 disclosed reports; one confirmed bounty: $5,000; latest 2024-08-28. Updated 2026-10-23._

## How it works
A string the attacker controls is handed to a component that treats it as a lookup expression rather than data. JNDI (and loggers that expand `${...}`) will fetch a remote reference from an attacker-named LDAP/DNS server and deserialize what comes back. The broken assumption is that such strings are inert configuration or log text; in fact they are executable references. The same applies to JAAS login-module config strings, where a tenant can name `JndiLoginModule` and point it at a rogue server [E1](https://bugbountylibrary.com/r/h1%3A1529790.md).

## Where it shows up
- Any property ending in `.sasl.jaas.config` or similar JAAS/login-module strings exposed to tenants (Kafka Connect, Debezium connectors) [E1](https://bugbountylibrary.com/r/h1%3A1529790.md)
- Log statements fed by HTTP headers, form fields, search parameters, chat messages [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-critical-rce-vulnerability-is-affecting-java.md)[E3](https://bugbountylibrary.com/r/h1%3A1430622.md)
- Outdated Log4j or other expression-expanding libraries still on the classpath [E3](https://bugbountylibrary.com/r/h1%3A1430622.md)
- `${jndi:...}`, `${lower:...}`, `${env:...}`, `${sys:...}` nesting in input [E3](https://bugbountylibrary.com/r/h1%3A1430622.md)
- Outbound LDAP/DNS triggered by request handling

## How to review
The invariant: no attacker-influenced string may reach a JNDI lookup or an expression-expanding logger as an expression. Check that (a) tenant-supplied JAAS config is restricted to an allowlist of login modules and URLs, not passed raw to the Kafka client [E1](https://bugbountylibrary.com/r/h1%3A1529790.md); (b) logging libraries are patched or JNDI expansion is disabled [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-critical-rce-vulnerability-is-affecting-java.md)[E3](https://bugbountylibrary.com/r/h1%3A1430622.md); (c) user input is escaped or parameterized before logging. Confirm by tracing each user-controlled field to its sink and verifying no `${...}` expansion occurs.

## Variants seen
- Connector SASL JAAS config selecting `JndiLoginModule` against a rogue LDAP server [E1](https://bugbountylibrary.com/r/h1%3A1529790.md)
- Log4j `${jndi:}` in logged headers/fields causing remote class loading [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-critical-rce-vulnerability-is-affecting-java.md)
- Obfuscated nested lookups bypassing WAF filters, leaking `${sys:user.name}` via DNS [E3](https://bugbountylibrary.com/r/h1%3A1430622.md)

## Why fixes fail
E3 shows an outdated Log4j component still present after the vulnerability was widely known, and obfuscation with nested `${lower:...}`/`${env:...}` defeated string-matching filters. Patching one library does not remove other expression sinks like JAAS config [E1](https://bugbountylibrary.com/r/h1%3A1529790.md).

## Impact and severity
Remote code execution on managed services and Java apps [E1](https://bugbountylibrary.com/r/h1%3A1529790.md)[E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-critical-rce-vulnerability-is-affecting-java.md), plus data exfiltration via DNS pingback even without code execution [E3](https://bugbountylibrary.com/r/h1%3A1430622.md). Severity is critical; worse when tenants can set arbitrary config properties [E1](https://bugbountylibrary.com/r/h1%3A1529790.md) and when egress filtering is absent, allowing LDAP callbacks.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1529790.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-rapid-response-critical-rce-vulnerability-is-affecting-java.md
- E3: https://bugbountylibrary.com/r/h1%3A1430622.md