We couldn't figure out the actual network bypass for this one, so it's not included in the post (even though it's in the CVE). It's gotta be in this function[0]

We couldn't figure out the actual network bypass for this one, so it's not included in the post (even though it's in the CVE). It's gotta be in this function[0] though, and if you have any notes we'd appreciate if you shared any notes with us! Edit: I spoke too soon! As we were writing this, somebody on Twitter figured it out[2]. Also, we just released v1.4 of the Log4Shell CLI tool for detecting + patching this vuln. Feel free to check that out on GitHub[1]. It's got a ton of improvements from the last release. 0: https://github.com/apache/logging-log4j2/blob/master/log4j-core/src/main/java/org/apache/logging/log4j/core/net/JndiManager.java#L221 https://github.com/apache/logging-log4j2/blob/master/log4j-c... 1: https://github.com/lunasec-io/lunasec/releases/ https://github.com/lunasec-io/lunasec/releases/ 2: https://twitter.com/marcioalm/status/1471740771581652995 https://twitter.com/marcioalm/status/1471740771581652995