[ConservativeMind]

“The trick is that, by default, unpatched versions of the Log4j library permit logging requests to trigger general-purpose LDAP (directory services) searches, as well as various other online lookups.”

You just proved it's not performing remote code execution. There's nothing in Log4j that lets you run any code. It does a lookup, but that is not executed code or arbitrary code.

[vikingd00d]

>>There’s nothing in Log4j that lets you run any code.

Did you miss THIS?

“And not just any old download: if the data that comes back is a valid Java program (a .class file, in the jargon), then the server runs that file to “help” it generate the logging data.”

Downloading and running arbitrary code seems like a bad idea.