cve: CVE-2021-44228
alias: Log4Shell
cwe_primary: CWE-917
cwe_acceptable: [CWE-917, CWE-94, CWE-20, CWE-502, CWE-74]
target_file: source.java
vuln_lines: [34, 35, 36]
severity: critical
vuln_class: expression_injection
exploit_pattern_regex: '\$\{jndi:(ldap|rmi|dns)://'
must_mention_any:
  - jndi
  - lookup
  - substitut
  - ${
  - attacker controlled
  - remote class
  - expression injection
  - code execution
points: 30
notes: |
  Vulnerability: format() invokes substitutor.replace(event, formatted) on the
  message body itself when it contains `${`. The substitutor resolves nested
  lookups including `${jndi:...}` which fetches and deserialises a remote class.
  Any logged user-controlled string becomes an RCE primitive.
  Hunter MUST identify:
    1. Recursive substitution of message body contents
    2. JNDI lookup is reachable through the substitutor
    3. Lack of lookups-disabled guard (`noLookups` is dead-code)