Skip to content

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories

Loading categories

log4j-test — Demonstration of CVE-2021-44228 with a possible strategic fix. | Kitploit

GitHub/strawhatasif/log4j-test

Vulnerability Analysis Exploitation Web Application Exploitation Supply Chain Security Learning & Education

strawhatasif/log4j-test

log4j-test

Demonstration of CVE-2021-44228 with a possible strategic fix.

View Repository

34 years ago

Most Popular

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

Share

Simple Example showing CVE-2021-44228 in action

Explanation

To reproduce this issue, I am removing the transitive dependency for logging from SpringBoot.
Instead, I am bringing in spring-boot-starter-log4j2
spring-boot-starter-log4j2 brings in log4j-core which has the remote code exploit (RCE) vulnerability.

Running API

Either run the command ./gradlew clean build bootRun in a terminal OR
Right click and click run in Log4TestApplication.java.

What happens when you pass in the JNDI value?

Because we are resolving to a non-existent site, we get a ConnectException.

But, imagine the possibilities if this was an actual malicious server!

Possible fix?

IF YOU ARE USING MAVEN - https://github.com/strawhatasif/log4j-test/tree/maven-variant
Located in the https://github.com/strawhatasif/log4j-test/tree/strategic-fix.

References:

https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.bleepingcomputer.com/news/security/new-zero-day-exploit-for-log4j-java-library-is-an-enterprise-nightmare/
https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j