Log4j RCE vulnerability explained with bypass for the initial fix (CVE-2021-44228, CVE-2021-45046)

[@BugBountyReportsExplained]

Welcome to the comment section! I hope this video was useful for you. If it was, make sure to leave a like and check out other videos about real-world vulnerabilities on my channel!

[@tyaprak]

I never miss a video. Great effort.

[@jozefwoo8079]

Very nice overview. I've consulted several resources and this one makes it very clear. Thanks.

[@BugBountyReportsExplained]

That's wonderful to hear!

[@CherSun1]

great explanation!

[@melvin16]

That was an awesome stuff my dear friend.

[@BugBountyReportsExplained]

it was!

[@mohamedalfadile6838]

really great 💥💥💥💥

[@montala3380]

I found the Log4J in my client-site (confirmed), I can extract small data via DNS Exfiltrate technique according to your video. Then I try to setup LDAP to get reverse shell, the site can contact to my LDAP but it always get stuck, and I cannot even get reverse shell or create a file in the server. What's the reason?

[@ssfdf7751]

yooooooooooo I've been waiting for this

[@BugBountyReportsExplained]

Me too, luckily this time I managd to publish it before new bypasses were found

[@Skatinima]

Really nicely explained👍

[@BugBountyReportsExplained]

thanks!

[@kosmonautofficial296]

Amazing video! Wow great stuff I appreciate it

[@BugBountyReportsExplained]

Thank you!

[@Joelvarghese6]

Best explanation out there

[@BugBountyReportsExplained]

Great to hear!

[@gigihadijaya5102]

keep going bro..🔥🔥

[@BugBountyReportsExplained]

I will🔥

[@egao57115]

Could I ask about why my server fetch the java class and execute it?
Cause of unserialize?
or others reason?

[@BugBountyReportsExplained]

It's a feature of JNDI to fetch the java class and execute it

[@_z3r0day]

Nice. Do you have any info about the recent CVE-2021-45105? It recommends to update log4j to 2.17.0

[@BugBountyReportsExplained]

I mentioned it in 08:11

[@atol71]

I just wonder if the log4j library has been used by Oracle (sic) developers in java JVM(JDK) development and has the whole Java ecosystem been compromised? Maybe? Eh? Could it?

[@BugBountyReportsExplained]

Luckily it's not that terrible

[@sketchwaretagalogtutorials]

Cool bro.

[@geekboyranjeet]

Nyc Video Sir 👍

[@BugBountyReportsExplained]

Thanks👍

[@bagasrizki973]

this epic 🔥

[@BugBountyReportsExplained]

🔥

[@Quir_Quest]

Log4j vulnerability creator??

[@BugBountyReportsExplained]

Chen Zhaojun from Alibaba Cloud Security Team

[@fahadfaisal2383]

Good

[@HackerSumitJi]

I want to contact you for business purpose, any email id? , Unable to contact you on twitter

[@BugBountyReportsExplained]

hi. Channel page > About > For business enquiries