Krisp · Report #1431624
Log4j CVE-2021–44228
Informativestatus
21upvotes
29 Dec 2021disclosed
Summary
The researcher's canary token got DNS interaction, which raised a false sense of log4shell vulnerability.
${hostName} would be exfiltrated if any of the processing servers were vulnerable, but as seen in the video submitted by the researcher just a plain DNS resolving was made.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.