Yes, that's already been established as an exfiltration vector: https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j https:

Yes, that's already been established as an exfiltration vector: https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j https://www.fastly.com/blog/digging-deeper-into-log4shell-0d... - note the ${jdni:dns:...} syntax bit in the middle. Combined with the WAF bypasses due to recursive expansion, this is going to get worse still.