Log4j2 vulnerability recurrence and analysis

Loophole recurrence ：

  give the result as follows ：

  It can be seen that it is not printed param Specific parameter information , Instead, the server version information is printed , This will create injection vulnerabilities , This vulnerability is due to JNDI As a result of , Here are the specific JNDI Inject

JNDI：RMI Inject

 

 

 

stay jdk8u121 7u131 6u141 Version start default com.sun.jndi.rmi.object.trustURLCodebase Set to false,rmi Loading remote bytecode will not execute successfully .