Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> That class needs to be on the server already

If you are talking about original log4shell then no! Jndi will grab a class definition from ldap, load it and then deserialize it.



Agreed, not being snarky, but isn't that what the "R" is in the (R)emote (C)ode (E)xecution is - The ability to trigger arbitrary code execution over a network (especially via a wide-area network such as the Internet)

https://en.wikipedia.org/wiki/Arbitrary_code_execution

The attacker can inject an LDAP URL with their own malicious code into a vulnerable website, via a request, that then is logged with logj4. The logging library if vulnerable will actually download and execute this remote malicious code, just by the attacker submitting the bad input. Obviously the vulnerable website needs to be logging this request information.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: