CVE-2021-22119: VMware Spring Security DoS Vulnerability

CVE-2021-22119 Overview

CVE-2021-22119 is a Denial of Service (DoS) vulnerability affecting VMware Spring Security, a widely-used authentication and access-control framework for Java applications. The vulnerability exists in the OAuth 2.0 Client implementation for both Web and WebFlux applications, where a malicious user can exhaust system resources by sending multiple Authorization Request initiations for the Authorization Code Grant flow.

This vulnerability allows attackers to exploit the authorization request mechanism without authentication, potentially causing service disruption through resource exhaustion using either a single session or multiple concurrent sessions.

Critical Impact
Unauthenticated attackers can cause service unavailability by exhausting system resources through repeated OAuth 2.0 Authorization Request initiations, impacting application availability for legitimate users.

Affected Products

VMware Spring Security versions 5.5.x prior to 5.5.1
VMware Spring Security versions 5.4.x prior to 5.4.7
VMware Spring Security versions 5.3.x prior to 5.3.10
VMware Spring Security versions 5.2.x prior to 5.2.11
Oracle Communications Cloud Native Core Policy version 1.14.0

Discovery Timeline

June 29, 2021 - CVE-2021-22119 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-22119

Vulnerability Analysis

The vulnerability stems from improper resource management in Spring Security's OAuth 2.0 Client implementation. When an application uses Spring Security's OAuth 2.0 Client module for authentication via the Authorization Code Grant flow, each authorization request initiation consumes server-side resources to maintain state information.

The weakness is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-863 (Incorrect Authorization). The OAuth 2.0 authorization flow requires the server to store authorization request attributes, typically in session storage, to validate the callback response. Without proper controls, an attacker can repeatedly initiate authorization requests, causing the server to allocate memory and processing resources for each request without completing the authentication flow.

This resource exhaustion attack is particularly effective because no authentication is required to initiate the authorization request, making it trivial for attackers to launch. The attack can be executed over the network without user interaction, targeting the availability of the affected application.

Root Cause

The root cause lies in the lack of rate limiting and resource constraints on OAuth 2.0 authorization request initiations within Spring Security's OAuth2AuthorizationRequestRedirectFilter. The framework did not implement adequate protections against repeated authorization request initiations from the same session or IP address, allowing unbounded resource allocation.

When processing authorization requests, the DefaultOAuth2AuthorizationRequestResolver creates and stores authorization request objects that persist until the OAuth flow completes or times out. Without proper cleanup mechanisms or limits on pending requests, memory and processing resources can be exhausted.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying an endpoint that triggers OAuth 2.0 authorization (typically /oauth2/authorization/{registrationId})
Sending multiple HTTP requests to initiate authorization flows
Not completing the authorization callback, leaving resources allocated
Repeating this process rapidly to exhaust server resources

The attack can be amplified by using multiple sessions or distributed sources, making it difficult to distinguish from legitimate traffic without proper monitoring.

Detection Methods for CVE-2021-22119

Indicators of Compromise

Abnormally high number of requests to OAuth 2.0 authorization endpoints (/oauth2/authorization/*)
Rapid increase in session creation without corresponding authentication completions
Memory utilization spikes in application servers handling OAuth flows
Elevated JVM heap usage without proportional increase in authenticated users

Detection Strategies

Monitor request rates to OAuth 2.0 authorization endpoints and alert on anomalous spikes
Track the ratio of authorization initiations to successful authentication completions
Implement application performance monitoring (APM) to detect resource exhaustion patterns
Use web application firewalls (WAF) to identify and block rapid repeated requests to authorization endpoints

Monitoring Recommendations

Configure logging for OAuth 2.0 authorization request events with source IP tracking
Set up alerts for session storage threshold breaches
Monitor garbage collection frequency and duration as an indicator of memory pressure
Implement distributed tracing to identify incomplete OAuth flows

How to Mitigate CVE-2021-22119

Immediate Actions Required

Upgrade Spring Security to patched versions: 5.5.1+, 5.4.7+, 5.3.10+, or 5.2.11+
Implement rate limiting on OAuth 2.0 authorization endpoints at the application or infrastructure layer
Configure session timeout policies to clean up abandoned authorization requests
Review and restrict access to OAuth 2.0 client endpoints where possible

Patch Information

VMware has released security patches addressing this vulnerability. Organizations should upgrade to the following minimum versions:

Spring Security 5.5.x: Upgrade to version 5.5.1 or later
Spring Security 5.4.x: Upgrade to version 5.4.7 or later
Spring Security 5.3.x: Upgrade to version 5.3.10 or later
Spring Security 5.2.x: Upgrade to version 5.2.11 or later

For detailed patch information, refer to the VMware CVE-2021-22119 Advisory. Oracle customers should consult the Oracle CPU January 2022 Alert for guidance on affected Oracle products.

Workarounds

Deploy a reverse proxy or WAF with rate limiting configured for OAuth endpoints
Implement IP-based request throttling for authorization initiation endpoints
Configure shorter session timeouts to reduce the window for resource accumulation
Consider disabling OAuth 2.0 client functionality if not required for application operation

bash

# Example: Rate limiting OAuth endpoints with nginx
# Add to nginx configuration for the affected application

limit_req_zone $binary_remote_addr zone=oauth_limit:10m rate=10r/s;

location /oauth2/authorization/ {
    limit_req zone=oauth_limit burst=20 nodelay;
    limit_req_status 429;
    proxy_pass http://backend;
}