Log4j Vulnerability and SAP (CVE-2021-44228)
A few days ago, on December 10th, 2021, Germany’s Federal Office for Information Security (BSI) has upgraded the cyber security warning for the critical security flaw in the widely used open-source Java logging library, Log4j, to warning level red. A lot has happened in the last few days. The affected module Apache Log4j is a logging tool used to ensure that log files are written or interpreted in Java-based applications. The “resolutions” used in this process (i.e., lookups via JDNI API) enable an attacker who can control log message parameters to execute arbitrary code which is loaded, e.g., from an Evil LDAP server.
The security gap, now known as Log4Shell, allows attackers to execute arbitrary code on remote servers to the point of a remote shell access, which makes it possible to access the compromised system. This also enables further attacks on internal systems.
The vulnerability CVE-2021-44228 is used in practically every Java-based application and is currently actively exploited. The risk according to the Common Vulnerability Scoring System (CVSSv3) was rated 10/10.
SAP applications and application servers (on-premise & cloud) are also affected by this vulnerability. Software developers, such as SAP, have already published a statement on the extent to which their systems have been affected and have offered appropriate patches. Here is a list of affected SAP applications, which SAP is constantly expanding. It shows which applications are currently not affected, where patches have already been implemented by SAP and where patches are still missing. This shows that SAP was able to act quickly, especially in the case of cloud products.
To avoid this and to secure your code against this vulnerability, it is recommended to upgrade your log4j library to a newer version, for example from version log4j 2.16.0 the vulnerable lookups are disabled by default. This vulnerability can be mitigated by setting “the log4j2.formatMsgNoLookups” parameter to “true” or by removing the class JndiLookup from the Java Classpath, which is not possible with versions log4j > 2.9. Based on current knowledge, all versions from 2.x to 2.14x are affected.
Of course, it is difficult to assess the exact impact of this vulnerability on companies using SAP, but this situation reveals once again that companies which have implemented adequate basic security measures won’t lose sleep over this issue. However, many companies using SAP often lack the implementation of rudimentary security measures for several reasons, such as time, costs or lack of knowledge.
Many attacks that occur on the network level via compromised hosts, possibly directly from the intranet, can be prevented with measures such as network segmentation or micro-segmentation as well as correctly configured firewalls. Finally, the attacked system must be able to establish an outbound connection to the attacker’s LDAP server, which should not be possible per se. It becomes apparent that basic network security and a clean zone concept can be of great help here.
These measures in combination with a token-based login to the SAP system (SSO), properly authorized SAP roles, RFC interfaces and security monitoring of your SAP landscape already offer solid protection against many potential attacks. Such monitoring should also recognize whether the SAP message server and the ACLs of the SAP gateways have been properly configured, whether the internal server communication has been secured in accordance with SAP Note 2040644 or whether TLS and SNC encryption has been implemented in the company, and much more.
What you can do
Xiting is a highly specialized SAP solution provider with an extensive service portfolio in the SAP security area. In the light of current events, we asked ourselves what practical solutions we can offer our customers and interested parties. The Security Architect module, integrated in the Xiting Authorizations Management Suite (XAMS), assists in this matter and can also be used in combination as a monitoring tool in the SIEM environment.
In addition, it is important to activate existing mechanisms, such as security encryption and other methods that are available in the SAP system. To this end, over the past few years, we have acquired enormous know-how together with our security experts.
If you are in doubt or have any questions regarding further security measures, talk to us. Based on an extensive system check, we are able to provide you with valuable information on how to increase your security and protection against all future attacks.
Find out more about our services here:
- Secure interfaces
- Security check of your SAP systems
- Security Support
With a security-minded approach, Carsten has international project and IT security experience in many industries. He has been working in IT-Security since 2001, specializing in SAP security since 2010. He is a subject matter expert for SAP Single Sign-On 3.0 and a trainer for the WDESSO course. His current focus is on supporting customers in solving authentication and security challenges within hybrid SAP landscapes, as well as designing and implementing holistic authentication concepts. Carsten is an ISACA CISA and a former MCP and RHCE with an ISP background, and he looks at security from different angles. He also translates between SAP and IT security vocabulary.
Carsten has in-depth experience in multi-vendor architectures and MSFT/Azure components, dealing with all the requirements concerning SAML 2.0, OAuth, OpenID Connect, SCIM, X.509 CBA & PKI, MFA, SAP SSO, and Secure Network Communications, Kerberos/SPNEGO, data security and encryption, as well as digital signatures.
Carsten is experienced in SAP on-premises components such as S/4HANA, ABAP, and Java, as well as security solutions like SSO 3.0. Since 2019, he has focused on SAP-Cloudified environments, specifically the SAP Cloud Identity Services and SAP BTP, as well as SaaS integrations concerning IAM. He deals with hybrid SAP security in conjunction with Azure Active Directory, ADDS, ADFS, ADCS, Reverse Proxies/WAF, SAP Web Dispatcher, SAP Cloud Connector, third-party products, and infrastructure components.
- Cloud Integration Made Easy: Xiting Central Workflows (XCW) Meets SAP Cloud - 30. July 2024
- From Nostalgia to Excitement: The Impending End of SAP IDM - 15. March 2024
- 2024 SAP Cloud Identity Services & IAM Portfolio: What’s New? - 23. February 2024
