Slide 13 of 28
Part 2 · How It WorksSlide 13
Slide 13 · Real Incident
Log4Shell (CVE-2021-44228) — RCE via third-party API data that reached the logger.
December 2021. A JNDI lookup string entered through an API integration path — not a user form — triggered remote code execution.
📄 CVE-2021-44228 · Apache Software Foundation · CISA · December 2021
THE VULNERABILITY
Apache Log4j 2 — JNDI Lookup Evaluation in Log Messages

Apache Log4j 2, the most widely used Java logging library, included a feature called JNDI lookup. When a log message contained the pattern ${jndi:ldap://host/path}, Log4j would initiate an outbound LDAP request to the specified host and potentially load and execute a Java class returned by the server. This was a “feature” designed for configuration lookups — but it evaluated any string in any log message.

The implication: any value that reached a Log4j log statement and contained ${jndi:...} would trigger an outbound connection — and potentially remote code execution. The source of the value did not matter: user input, HTTP headers, database values, or third-party API responses.

The API10 path: Many APIs consumed third-party data that was later logged. Geolocation APIs returned city and country names — logged for analytics. User-agent normalization services returned structured device data — logged for debugging. E-commerce enrichment APIs returned product metadata — logged for inventory tracking. An attacker who could influence what a third-party API returned — or who compromised any of these third-party services — could deliver a Log4Shell payload through the trusted data path. The consuming API never validated the third-party data before logging it. The JNDI string was treated as ordinary data from a trusted source. CVE-2021-44228 was rated CVSS 10.0 (maximum). CISA ordered all U.S. federal agencies to patch within one week. Millions of servers worldwide were vulnerable, and mass exploitation began within 24 hours of public disclosure on December 9, 2021.
The API10 lesson from Log4Shell

Log4Shell was primarily exploited through direct user-controlled input (HTTP headers, request parameters). But the API10 variant — delivery through third-party API responses — was also a real attack path. Applications that validated and sanitized user input still logged third-party data without review. The assumption: “this data came from our geolocation provider, it’s just a city name.” That assumption is the vulnerability.

← Back Attack Scenarios →