> proof-of-concept (PoC) code has evidently been available since March of 2021 This Github repo was for an older vulnerability[1] (CVE-2019-17571). > monitor

> proof-of-concept (PoC) code has evidently been available since March of 2021 This Github repo was for an older vulnerability[1] (CVE-2019-17571). > monitor web application logs for evidence of attempts to execute methods from remote codebases (i.e. looking for jndi:ldap strings) As the templates are interpreted recursively, the payload can easily be obfuscated, e.g. using "${${lower:j}${lower:n}..."[2]. I saw e.g. binaryedge's scanner already use that trick. [1] https://www.cnblogs.com/nice0e3/p/14531327.html https://www.cnblogs.com/nice0e3/p/14531327.html [2] https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce#bypass-waf https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j...