Visual Studio 2019 SSIS-Extension log4j files

This is not a problem.

In what way those .jar file can be exploited to trig a privilege escalation or software evasion?

The fact that Visual Studio is using old libraries doesn't shock me at all. Large companies are use to rely on third party library and then they are usually forbidden in the corner during years.

EDIT:

You question was somehow interesting and I needed to dig further.

Apparently this 0-day has been around since March, so it means 9 month ago. There is no evidence of mass exploitation but that doesn't mean that it hasn't been used in the past months.

In order to use it:

[...] an attacker only needs to get the system to log a strategically crafted string of code. From there they can load arbitrary code on the targeted server and install malware or launch other attacks. Notably, hackers can introduce the snippet in seemingly benign ways, like by sending the string in an email or setting it as an account username.

This means that hypothetically you can exploit the vulnerability through SSIS in this scenario:

1. Create an SSIS package that ask for an input to the client user
2. The package must use log4j for logging
3. The user enter the malicious crafted string of code

...then yes in this case an SSIS package could be exploited.

I will try it out in my spare time and I will let you know.