Executive brief
Apache Log4j is a widely used logging library for Java applications. A vulnerability in an optional component called JDBCAppender allows attackers to execute unauthorized database commands by sending specially crafted data (such as web headers or form input) that the application then logs. This could lead to the theft of sensitive data, modification of database records, or a complete compromise of the connected database.
Technical details
A SQL injection vulnerability exists in the JDBCAppender of Apache Log4j 1.2.x. The component constructs SQL statements by interpolating PatternLayout converters, such as the message converter (%m), directly into SQL strings without proper sanitization. An attacker can exploit this by providing crafted input (e.g., via HTTP headers or application fields) that is subsequently logged, allowing the execution of arbitrary SQL queries. This issue specifically affects Log4j 1.x when the non-default JDBCAppender is enabled. Because Log4j 1.2 reached end-of-life in 2015, no official patch is available; users are advised to migrate to Log4j 2.x, which uses parameterized queries.
Affected products
- Apache Log4j <= 1.2.17
Timeline
- 2015-08-05: other: Log4j 1.2 reached end of life
- 2022-01-18: disclosed: NVD publication date
- 2022-01-21: advisory: GitHub Advisory published