<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.14.0</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>2.14.0</version>
</dependency>
Last updated
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
public class Log4Vul {
private static final Logger logger = LogManager.getLogger();
public static void main(String[] args) {
String food = "taco";
logger.error("{} is not served", food);
// 12:17:56.859 [main] ERROR Log4Vul - taco is not served
}
}public String lookup(final LogEvent event, final String key) {
if (key == null) {
return null;
}
final String jndiName = convertJndiName(key);
try (final JndiManager jndiManager = JndiManager.getDefaultManager()) {
return Objects.toString(jndiManager.lookup(jndiName), null);
} // ....
}