CVE-2022-23305

Q: What is the severity of CVE-2022-23305?

CVE-2022-23305 has a CVSS score of 9.8 (CRITICAL). CVE-2022-23305 is an SQL injection vulnerability in Log4j 1.2.x's JDBCAppender that allows attackers to execute arbitrary SQL queries by injecting malicious strings into application inputs that get logged. This affects applications using Log4j 1.2.x with JDBCAppender specifically configured, though this is not the default configuration. Log4j 1.x reached end-of-life in 2015, so affected systems are running outdated software.

9.8 CRITICAL

SQL Injection

📋 TL;DR

CVE-2022-23305 is an SQL injection vulnerability in Log4j 1.2.x's JDBCAppender that allows attackers to execute arbitrary SQL queries by injecting malicious strings into application inputs that get logged. This affects applications using Log4j 1.2.x with JDBCAppender specifically configured, though this is not the default configuration. Log4j 1.x reached end-of-life in 2015, so affected systems are running outdated software.

💻 Affected Systems

Products:

Apache Log4j

Versions: 1.2.x (all versions)

Operating Systems: All

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when JDBCAppender is explicitly configured and used. Log4j 1.x reached end-of-life in August 2015.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including data theft, data destruction, privilege escalation, and potential remote code execution through database functions.

🟠

Likely Case

Data exfiltration, database manipulation, or denial of service through SQL injection attacks.

🟢

If Mitigated

Limited impact if proper input validation, parameterized queries, and network segmentation are implemented.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires the application to log user-controlled input and use JDBCAppender with PatternLayout containing %m converter.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: N/A

Vendor Advisory: https://logging.apache.org/log4j/1.2/index.html

Restart Required: Yes

Instructions:

1. Upgrade to Log4j 2.x (version 2.0-beta8 or later). 2. Remove JDBCAppender configuration from Log4j 1.x if upgrading is not immediately possible. 3. Test the upgrade in a non-production environment first.

🔧 Temporary Workarounds

Disable JDBCAppender

all

Remove or disable JDBCAppender configuration from log4j.properties or log4j.xml files

# Edit log4j configuration files and remove JDBCAppender entries
# Example: Remove lines containing 'log4j.appender.JDBC' or similar

Implement Input Validation

all

Add strict input validation and sanitization for all user inputs that get logged

🧯 If You Can't Patch

Implement network segmentation to isolate vulnerable systems from critical databases
Deploy web application firewall (WAF) with SQL injection protection rules

🔍 How to Verify

Check if Vulnerable:

Check log4j configuration files for JDBCAppender usage and verify Log4j version is 1.2.x

Check Version:

Check application dependencies or classpath for log4j-1.2.x.jar files

Verify Fix Applied:

Confirm Log4j version is 2.0-beta8 or later, or verify JDBCAppender is removed from configuration

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs from application servers
SQL syntax errors in application logs

Network Indicators:

Unusual database connections from application servers
SQL injection patterns in HTTP requests

SIEM Query:

source="database_logs" AND (sql_injection_keywords OR unusual_query_patterns)

📊 Metadata

CVE ID: CVE-2022-23305

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: January 18, 2022

Last Updated: November 21, 2024

🔗 References

http://www.openwall.com/lists/oss-security/2022/01/18/4 Mailing List,Third Party Advisory
https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y Issue Tracking,Mailing List,Vendor Advisory
https://logging.apache.org/log4j/1.2/index.html Vendor Advisory
https://security.netapp.com/advisory/ntap-20220217-0007/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch,Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/18/4 Mailing List,Third Party Advisory
https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y Issue Tracking,Mailing List,Vendor Advisory
https://logging.apache.org/log4j/1.2/index.html Vendor Advisory
https://security.netapp.com/advisory/ntap-20220217-0007/ Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch,Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Advanced Supply Chain Planning by Oracle

Advanced Supply Chain Planning by Oracle

Brocade Sannav by Broadcom

Business Intelligence by Oracle

Business Intelligence by Oracle

Business Intelligence by Oracle

Business Process Management Suite by Oracle

Business Process Management Suite by Oracle

Communications Eagle Ftp Table Base Retrieval by Oracle

Communications Instant Messaging Server by Oracle

Communications Messaging Server by Oracle

Communications Network Integrity by Oracle

Communications Offline Mediation Controller by Oracle

Communications Offline Mediation Controller by Oracle

Communications Unified Inventory Management by Oracle

Communications Unified Inventory Management by Oracle

E Business Suite Cloud Manager And Cloud Backup Module by Oracle

E Business Suite Cloud Manager And Cloud Backup Module by Oracle

E Business Suite Information Discovery by Oracle

Enterprise Manager Base Platform by Oracle

Enterprise Manager Base Platform by Oracle

Financial Services Revenue Management And Billing Analytics by Oracle

Financial Services Revenue Management And Billing Analytics by Oracle

Financial Services Revenue Management And Billing Analytics by Oracle

Healthcare Foundation by Oracle

Hyperion Data Relationship Management by Oracle

Hyperion Infrastructure Technology by Oracle

Identity Management Suite by Oracle

Identity Management Suite by Oracle

Identity Manager Connector by Oracle

Jdeveloper by Oracle

Log4j by Apache

Middleware Common Libraries And Tools by Oracle

Mysql Enterprise Monitor by Oracle

Reload4j by Qos

Retail Extract Transform And Load by Oracle

Snapmanager by Netapp

Snapmanager by Netapp

Tuxedo by Oracle

Weblogic Server by Oracle

Weblogic Server by Oracle

Weblogic Server by Oracle

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable JDBCAppender

Implement Input Validation

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities