Log4Shell (CVE-2021-44228) — Research Report

A self-contained technical report on Log4Shell, the critical Remote Code Execution vulnerability in Apache Log4j 2 disclosed in December 2021. Covers root cause analysis, the full attack chain, detection/mitigation guidance, and an end-to-end exploit reproduction carried out in an isolated local lab, with terminal and log evidence.

View the live report →

What's inside

• Vulnerability overview — what Log4Shell is and why it was catastrophic
• Technical analysis — the vulnerable code path in JndiLookup.java and the four-step attack flow
• Proof of Concept — full walkthrough: vulnerable Docker target, malicious LDAP redirector (marshalsec), payload class, and trigger
• Lab verification — screenshots from an actual local reproduction of the exploit chain (target setup, LDAP/HTTP server logs, and confirmed code execution)
• Disclosure timeline — key dates from discovery to full patch
• Detection & mitigation — log-based detection patterns and the official JVM/version-based fixes

Tech / sources

• Target app: christophetd/log4shell-vulnerable-app (Log4j 2.14.1)
• JNDI/LDAP redirector: mbechler/marshalsec
• All content is static HTML/CSS — no build step, no dependencies

Running locally

Just open the file in a browser — no server required:

git clone https://github.com/sanasimran1403-jpg/log4shell-report-with-evidence.git
cd log4shell-report-with-evidence
open index.html   # or double-click it

Disclaimer

This report and its accompanying lab reproduction are for educational and authorized security research purposes only. All exploitation shown was performed against a deliberately vulnerable application in an isolated local Docker environment controlled by the author. Testing systems without explicit written authorization is illegal under the CFAA, UK Computer Misuse Act, and equivalent laws elsewhere.

Author: Sana Simran — S&S Independent Security Research, 2026