CVE-2021-45046 Vulnerability

The vulnerability stems from improper handling of Java Naming and Directory Interface (JNDI) lookups in Log4j. Exploits occur when attackers craft malicious log messages containing specially formatted data that bypass initial mitigations. This flaw allows adversaries to escalate access and execute arbitrary code. A proof-of-concept exploit demonstrated the severity in vulnerable configurations.

Tactics, Techniques & Procedures (TTPs)

Attackers exploit CVE-2021-45046 by sending crafted input to vulnerable applications, often masking malicious payloads in JSON/HTTP headers or logs. Once executed, the payloads can create backdoors or lateral movement tools.

Indicators of compromise

Monitor for irregular JNDI requests, unexpected inbound connections from untrusted IPs, or abnormal execution of Java processes. Examine application logs for suspiciously formatted strings and flags indicative of exploitation attempts.

Known proof-of-concepts & exploits

Numerous proof-of-concept scripts exist across exploit frameworks, including public repositories. Exploitation attempts were rapidly observed in the wild after disclosure, targeting enterprise software and internal applications using Log4j.