Demonstration of CVE-2021-44228 with a possible strategic fix.## Simple Example showing CVE-2021-44228 in action
### Explanation
* To reproduce this issue, I am removing the transitive dependency for logging from SpringBoot.
* Instead, I am bringing in `spring-boot-starter-log4j2`
* `spring-boot-starter-log4j2` brings in `log4j-core` which has the remote code exploit (RCE) vulnerability.
### Running API
* Either run the command `./gradlew clean build bootRun` in a terminal **OR**
* Right click and click `run` in `Log4TestApplication.java`.
### What happens when you pass in the JNDI value?
* Because we are resolving to a non-existent site, we get a `ConnectException`.
* But, imagine the possibilities if this was an actual malicious server!
### Possible fix?
* **IF YOU ARE USING MAVEN** - https://github.com/strawhatasif/log4j-test/tree/maven-variant
* Located in the https://github.com/strawhatasif/log4j-test/tree/strategic-fix.
### References:
* https://www.lunasec.io/docs/blog/log4j-zero-day/
* https://www.bleepingcomputer.com/news/security/new-zero-day-exploit-for-log4j-java-library-is-an-enterprise-nightmare/
* https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j
[4.0K] /data/pocs/7292ad76f5f27f22bd22f77b65138cde2f521633
├── [ 669] build.gradle
├── [4.0K] gradle
│ └── [4.0K] wrapper
│ ├── [ 58K] gradle-wrapper.jar
│ └── [ 202] gradle-wrapper.properties
├── [7.9K] gradlew
├── [2.6K] gradlew.bat
├── [231K] img.png
├── [1.2K] README.md
├── [ 32] settings.gradle
└── [4.0K] src
└── [4.0K] main
├── [4.0K] java
│ └── [4.0K] com
│ └── [4.0K] fun
│ └── [4.0K] log4jtest
│ ├── [4.0K] controller
│ │ └── [ 700] SomeController.java
│ └── [ 316] Log4jTestApplication.java
└── [4.0K] resources
└── [ 1] application.properties
10 directories, 11 files