christophetd/log4shell-vulnerable-app

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1140 stars · 551 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A deliberately vulnerable Spring Boot web application demonstrating the Log4Shell vulnerability (CVE-2021-44228) using Log4j 2.14.1. It ships as a Docker image with documented exploitation steps for security testing and education.

Use cases

• test log4shell detection tools
• demonstrate cve-2021-44228 exploitation
• train developers on log4j vulnerability
• verify waf rules against jndi injection
• reproduce log4shell in a sandbox
• practice penetration testing on a safe target

When to choose

• you need a safe, reproducible target to test Log4Shell detections or mitigations
• you are teaching or demonstrating how CVE-2021-44228 works
• you want to validate security tooling against a known-vulnerable app

When to avoid

• you need a production or hardened application
• you cannot run it in an isolated sandbox environment
• you need a maintained application rather than a frozen vulnerable demo

Facets

application · maturity maintenance

security penetration-testing web-framework security penetration-testing developer-tools web-development jvm self-hosted log4shell cve-2021-44228 vulnerable-app security-training spring-boot exploit-demo docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="christophetd/log4shell-vulnerable-app")