What is JNDI?

JNDI is the acronym for Java Naming and Directory Interface, which is a Java API for consuming certain services oriented to searching for objects on a network.

JNDI is commonly used to associate logical names with resources, analogous to how the DNS service associates FQDNs with IPs. For example, when an EJB (Enterprise JavaBeans) requests a resource from JNDI, it passes the request to the corresponding service and returns the resource.

Among the services supported by JNDI, LDAP, RMI or DNS stand out, among others, which were actively used to attack vulnerable Log4J components (see CVE-2021-44228) through JNDI Injection-type attacks. This attack was commonly known as “Log4Shell“, which was extensively studied and monitored by our Threat Hunting service.