CVE-2021-22119: VMware Spring Security DoS Vulnerability

CVE-2021-22119 Overview

CVE-2021-22119 is a Denial of Service (DoS) vulnerability affecting VMware Spring Security, a widely-used authentication and access-control framework for Java applications. The vulnerability exists in the OAuth 2.0 Client implementation for both Web and WebFlux applications, where a malicious user can exhaust system resources by sending multiple Authorization Request initiations for the Authorization Code Grant flow.

This vulnerability allows attackers to exploit the authorization request mechanism without authentication, potentially causing service disruption through resource exhaustion using either a single session or multiple concurrent sessions.

Critical Impact

Unauthenticated attackers can cause service unavailability by exhausting system resources through repeated OAuth 2.0 Authorization Request initiations, impacting application availability for legitimate users.

Affected Products

• VMware Spring Security versions 5.5.x prior to 5.5.1
• VMware Spring Security versions 5.4.x prior to 5.4.7
• VMware Spring Security versions 5.3.x prior to 5.3.10
• VMware Spring Security versions 5.2.x prior to 5.2.11
• Oracle Communications Cloud Native Core Policy version 1.14.0

Discovery Timeline

• June 29, 2021 - CVE-2021-22119 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-22119

Vulnerability Analysis

The vulnerability stems from improper resource management in Spring Security's OAuth 2.0 Client implementation. When an application uses Spring Security's OAuth 2.0 Client module for authentication via the Authorization Code Grant flow, each authorization request initiation consumes server-side resources to maintain state information.

The weakness is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-863 (Incorrect Authorization). The OAuth 2.0 authorization flow requires the server to store authorization request attributes, typically in session storage, to validate the callback response. Without proper controls, an attacker can repeatedly initiate authorization requests, causing the server to allocate memory and processing resources for each request without completing the authentication flow.

This resource exhaustion attack is particularly effective because no authentication is required to initiate the authorization request, making it trivial for attackers to launch. The attack can be executed over the network without user interaction, targeting the availability of the affected application.

Root Cause

The root cause lies in the lack of rate limiting and resource constraints on OAuth 2.0 authorization request initiations within Spring Security's OAuth2AuthorizationRequestRedirectFilter. The framework did not implement adequate protections against repeated authorization request initiations from the same session or IP address, allowing unbounded resource allocation.

When processing authorization requests, the DefaultOAuth2AuthorizationRequestResolver creates and stores authorization request objects that persist until the OAuth flow completes or times out. Without proper cleanup mechanisms or limits on pending requests, memory and processing resources can be exhausted.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an endpoint that triggers OAuth 2.0 authorization (typically /oauth2/authorization/{registrationId})
2. Sending multiple HTTP requests to initiate authorization flows
3. Not completing the authorization callback, leaving resources allocated
4. Repeating this process rapidly to exhaust server resources

The attack can be amplified by using multiple sessions or distributed sources, making it difficult to distinguish from legitimate traffic without proper monitoring.

Detection Methods for CVE-2021-22119

Indicators of Compromise

• Abnormally high number of requests to OAuth 2.0 authorization endpoints (/oauth2/authorization/*)
• Rapid increase in session creation without corresponding authentication completions
• Memory utilization spikes in application servers handling OAuth flows
• Elevated JVM heap usage without proportional increase in authenticated users

Detection Strategies

• Monitor request rates to OAuth 2.0 authorization endpoints and alert on anomalous spikes
• Track the ratio of authorization initiations to successful authentication completions
• Implement application performance monitoring (APM) to detect resource exhaustion patterns
• Use web application firewalls (WAF) to identify and block rapid repeated requests to authorization endpoints

Monitoring Recommendations

• Configure logging for OAuth 2.0 authorization request events with source IP tracking
• Set up alerts for session storage threshold breaches
• Monitor garbage collection frequency and duration as an indicator of memory pressure
• Implement distributed tracing to identify incomplete OAuth flows

How to Mitigate CVE-2021-22119

Immediate Actions Required

• Upgrade Spring Security to patched versions: 5.5.1+, 5.4.7+, 5.3.10+, or 5.2.11+
• Implement rate limiting on OAuth 2.0 authorization endpoints at the application or infrastructure layer
• Configure session timeout policies to clean up abandoned authorization requests
• Review and restrict access to OAuth 2.0 client endpoints where possible

Patch Information

VMware has released security patches addressing this vulnerability. Organizations should upgrade to the following minimum versions:

• Spring Security 5.5.x: Upgrade to version 5.5.1 or later
• Spring Security 5.4.x: Upgrade to version 5.4.7 or later
• Spring Security 5.3.x: Upgrade to version 5.3.10 or later
• Spring Security 5.2.x: Upgrade to version 5.2.11 or later

For detailed patch information, refer to the VMware CVE-2021-22119 Advisory. Oracle customers should consult the Oracle CPU January 2022 Alert for guidance on affected Oracle products.

Workarounds

• Deploy a reverse proxy or WAF with rate limiting configured for OAuth endpoints
• Implement IP-based request throttling for authorization initiation endpoints
• Configure shorter session timeouts to reduce the window for resource accumulation
• Consider disabling OAuth 2.0 client functionality if not required for application operation

# Example: Rate limiting OAuth endpoints with nginx
# Add to nginx configuration for the affected application

limit_req_zone $binary_remote_addr zone=oauth_limit:10m rate=10r/s;

location /oauth2/authorization/ {
    limit_req zone=oauth_limit burst=20 nodelay;
    limit_req_status 429;
    proxy_pass http://backend;
}