The Last Log4j Talk You Ever Need: Minecraft Homelabs to Enterprise Supply Chains
Ochuan Marshall breaks down Log4Shell (CVE-2021-44228), demonstrating how to exploit JNDI lookups in a Minecraft homelab and secure software supply chains.
Summary
Deconstructing the Log4Shell Vulnerability (CVE-2021-44228)
Log4Shell exposed systemic flaws in Java logging architectures, allowing unauthenticated remote attackers to trigger arbitrary JNDI lookups over LDAP.
Building a Local Minecraft Homelab with Vagrant
Ochuan Marshall demonstrates setting up an isolated virtual test environment with older Java and Minecraft server builds to observe JNDI lookups in real time.
Weaponizing JNDI Lookup Injections via Chat Messages
The speaker illustrates how injecting a simple `${jndi:ldap://...}` payload into in-game chat or web headers executes remote code with minimal friction.
Supply Chain Hardening and Application Security Lessons
The presentation provides decision-makers and engineers with actionable strategies for auditing third-party Java dependencies and enforcing secure logging configurations.
Related talks
Main Stage·38 min
Thomas Chauchefoin · Paul Gerste
Uncovers critical RCE vulnerabilities in Visual Studio Code, demonstrating how malicious repository configurations bypass Workspace Trust protections.
Main Stage·45 min
Rotem Bar
Rotem Bar turns static application security testing (SAST) tools and linters against developers, weaponizing malicious repositories to achieve RCE during source code scanning.
Main Stage·23 min
David Dworken
David Dworken challenges the developer trust model by discovering critical vulnerabilities in modern IDEs (VS Code, IntelliJ) that execute code simply upon opening a repo.