> That class needs to be on the server already
If you are talking about original log4shell then no! Jndi will grab a class definition from ldap, load it and then deserialize it.
If you are talking about original log4shell then no! Jndi will grab a class definition from ldap, load it and then deserialize it.
https://en.wikipedia.org/wiki/Arbitrary_code_execution
The attacker can inject an LDAP URL with their own malicious code into a vulnerable website, via a request, that then is logged with logj4. The logging library if vulnerable will actually download and execute this remote malicious code, just by the attacker submitting the bad input. Obviously the vulnerable website needs to be logging this request information.