Log4Shell Armageddon or Opportunity
summary
Log4j’s lookup feature lets logged input trigger recursive JNDI lookups that can call out to attacker-controlled LDAP/RMI/DNS servers, return serialized objects (gadget chains) and deliver arbitrary remote code execution. Demo shows payloads expanding in logs, outbound lookups that leak classpath and Java version, and OOM/crash vectors from malicious serialization. Bots and fuzzers probe constantly; Sonatype metrics show ~40% of downloads still use vulnerable versions. Practical fixes: update to the latest Log4j, verify dependency scanners, or temporarily disable JNDI lookups.
AI-written summary · about
chapters (9)
- 0:00Introduction to Log4Shell
- 5:33What is Log4Shell
- 13:04How Log4Shell works
- 21:20Live demo attempt
- 26:47Exploiting the vulnerability
- 34:19Gadget chains and RCE
- 37:09Version vulnerabilities
- 40:00Current threat landscape
- 42:27Q&A begins
related talks
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
51mDouble plus Ungood Why Log4Shell Is So Bad
17mLog4j - A Placement Student's Baptism by Fire
46mThe Next Log4jshell?! Preparing for CVEs with eBPF!
58mWhat the log4j incident taught us about Secure by Design
02h 38mJava application security the hard way - a workshop for the serious developer
27mLog4Shell - The Open Source World on Fire
48mA Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land