Exploitation of Log4j CVE-2021-44228 before public disclosure and evolution of evasion and exfiltration

This post details the observed evolution of WAF evasion techniques and exfiltration attempts in response to the Log4j CVE-2021-44228 vulnerability. It analyzes the shift from simple attack strings to complex obfuscation methods using Log4j's built-in lookups (e.g., `${lower}`, `${env}`, `${sys}`) and demonstrates how these techniques are used to bypass WAF rules and exfiltrate sensitive data. The post also provides trend data on exploitation attempts and highlights instances of pre-disclosure exploitation, underscoring the need for continuous WAF adaptation and prompt patching.