Attacks and malware
What is Log4Shell?
The 2021 vulnerability in the Log4j logging library that let an attacker run code by getting a string into a log message.
Log4Shell is the name given to CVE-2021-44228, a critical vulnerability in the Apache Log4j 2 Java logging library disclosed in December 2021. A crafted string reaching a log message could make the library fetch and run code from a remote server.
It was severe because Log4j was embedded in a huge range of software, and because the attacker only needed to get text into a log, for example through a username field or an HTTP header. Exploitation started within hours of disclosure.