The Log4Shell vulnerability (CVE-2021-44228) is one of the most serious security threats in recent decades. This remote code execution (RCE) flaw in the Apache Log4j logging framework allows unauthenticated attackers to remotely execute arbitrary code, potentially leading to the complete compromise of affected SAP applications and systems.
What is the Log4J vulnerability?
Log4j is an open-source Java logging utility that includes the Java Naming and Directory Interface (JNDI) API. The vulnerability allows attackers to pass specially crafted strings through JNDI, forcing Log4j to query malicious servers, download serialized Java code, and execute it.
- Impacted Versions: All versions of Log4j2 up to and including 2.14.1 (in Java 8 or higher).
- Severity: With a base CVSS score of 10.0, it is actively exploited by threat actors—including nation-state groups—to deploy ransomware and gain persistent network access.
- Mitigation: Message lookup substitution is disabled by default in version 2.15.0 and removed entirely in 2.16.0. Organizations should upgrade to the latest secure version immediately.
How to secure SAP solutions against Log4Shell
Because Log4j is bundled within multiple SAP solutions, including SAP HANA XSA, a coordinated patching effort is required.
- Official SAP Guidance: Consult the official SAP response for a comprehensive list of impacted products.
- Patching: Refer to central note 3131047 for available patches for your specific SAP solutions.
- Workarounds: If immediate patching is not possible, apply the manual workaround detailed in note 3129883, which uses the J2EE Config Tool to disable the loading of external code in Log4j.
Proactive Detection with the Cybersecurity Extension for SAP
The Cybersecurity Extension for SAP provides automated discovery to identify vulnerable ABAP, Java, and Web Dispatcher installations that have not been correctly patched. The solution also monitors for suspected exploit signatures, including known obfuscation and bypass methods, providing real-time alerts to protect your SAP landscape.
Frequently Asked Questions
Why is Log4Shell so dangerous?
Log4Shell is highly dangerous because it requires no authentication and minimal complexity to exploit. It allows an attacker to achieve remote code execution, granting them full control over the vulnerable application or system.
Which SAP applications are impacted?
Log4j is bundled in numerous SAP applications, most notably SAP HANA XSA. Because the library is widely used, organizations should refer to the official SAP response to check the status of all installed SAP products.
Can I mitigate the risk without patching?
Yes, SAP provides manual procedures in note 3129883 that disable the loading of external code in Log4j using the J2EE Config Tool. This serves as a critical stop-gap measure for systems that cannot be patched immediately.