In the Log4j case, an attacker would make malicious requests via WebSockets to a potentially vulnerable localhost or local network server. The targets don’t have to be exposed to the internet.

A simple full-stack JavaScript application lets you see what happens under the hood in the WebSockets communication protocol.