Log4j Vulnerability, Log4shell, Exploit, Web Attack.
http GET or POST request. So SOP and CORS don’t help here as long as the requirements for a simple request are satisfied. This also restricts the attack so you won’t be able to set custom http headers as these would require a CORS preflight. And therefore the web socket attack vector is “just”