← Attack Cinema
CVE-2021-44228CVSS 10.02021-12-09
Log4Shell
How one log line owned the internet.
A string like ${jndi:ldap://…} inside any value logged by Apache Log4j 2.x caused the JVM to fetch and execute code from an attacker-controlled LDAP server. Remote code execution. No authentication. Logging the string was enough.
1 / 10
T+0PUBLIC
Disclosure hits Twitter
December 9, 2021 — a researcher publishes a proof-of-concept showing that Minecraft chat messages can execute code on the server. Within an hour the scope expands: anything that logs user input via Log4j is vulnerable. Tomcat. Elasticsearch. Steam. iCloud. Tesla. You.
Disclosure lands. The whole internet is suddenly a target list.