CVE-2021-35564 Overview
CVE-2021-35564 is a vulnerability in the Java SE and Oracle GraalVM Enterprise Edition products affecting the Keytool component. This easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to compromise affected Java installations. The vulnerability primarily impacts integrity, enabling unauthorized update, insert, or delete access to some accessible data within the affected Java environments.
This vulnerability is particularly relevant to Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from the internet while relying on the Java sandbox for security. Additionally, the vulnerability can be exploited through APIs in the Keytool component, such as via web services that supply data to these APIs.
Critical Impact
Unauthenticated attackers can remotely modify data in Java SE and Oracle GraalVM Enterprise Edition deployments through the vulnerable Keytool component without user interaction.
Affected Products
- Oracle GraalVM Enterprise Edition 20.3.3 and 21.2.0
- Oracle OpenJDK 7u311, 8u301, 11.0.12, and 17
- NetApp Active IQ Unified Manager (VMware vSphere and Windows)
- NetApp E-Series SANtricity OS Controller, Storage Manager, and Web Services
- NetApp HCI Management Node, OnCommand Insight, OnCommand Workflow Automation
- NetApp SANtricity Unified Manager, SnapManager (Oracle and SAP), SolidFire
- Fedora 33, 34, and 35
- Debian Linux 9.0, 10.0, and 11.0
Discovery Timeline
- October 20, 2021 - CVE-2021-35564 published to NVD
- November 21, 2024 - Last updated in NVD database
Technical Details for CVE-2021-35564
Vulnerability Analysis
The vulnerability resides in the Keytool component of Java SE and Oracle GraalVM Enterprise Edition. Keytool is a key and certificate management utility that manages keystores containing cryptographic keys, X.509 certificate chains, and trusted certificates. The flaw allows unauthenticated attackers to perform unauthorized data modifications through network-accessible interfaces.
The attack requires no authentication or user interaction, making it exploitable across multiple network protocols. The vulnerability specifically affects data integrity without impacting confidentiality or availability. Organizations running Java-based applications that process untrusted input through Keytool APIs or related web services are at risk.
Root Cause
The root cause is an improper input validation or access control issue within the Keytool component that fails to adequately restrict unauthorized modification operations. When processing network-accessible requests, the component does not properly validate the authorization level of the requester, allowing unauthenticated users to perform data modification operations that should require elevated privileges.
Attack Vector
The attack vector is network-based, requiring no privileges or user interaction. An attacker can exploit this vulnerability by:
- Identifying a target system running a vulnerable version of Java SE or Oracle GraalVM Enterprise Edition
- Crafting malicious requests targeting the Keytool component through network protocols
- Sending requests via web services or other network-accessible APIs that interact with the vulnerable component
- Successfully modifying, inserting, or deleting data within the affected Java deployment
The vulnerability is particularly dangerous in environments where Java Web Start applications or Java applets load untrusted code from the internet, as well as web services that expose Keytool APIs to external inputs.
Detection Methods for CVE-2021-35564
Indicators of Compromise
- Unexpected modifications to keystore files or certificate data
- Anomalous network traffic patterns targeting Java application ports
- Unauthorized changes to trusted certificate chains or cryptographic keys
- Suspicious API calls to Keytool-related endpoints from external sources
Detection Strategies
- Monitor Java application logs for unusual Keytool operations or error messages
- Implement network-level monitoring for suspicious traffic targeting Java services
- Deploy integrity monitoring on keystore files and certificate stores
- Analyze web service logs for unauthorized requests to Keytool APIs
Monitoring Recommendations
- Configure alerting for unexpected keystore file modifications
- Establish baseline network traffic patterns for Java applications and alert on anomalies
- Implement application-level logging for all Keytool component interactions
- Monitor for unauthorized certificate or key management operations
How to Mitigate CVE-2021-35564
Immediate Actions Required
- Update Java SE installations to patched versions released after October 2021
- Upgrade Oracle GraalVM Enterprise Edition to versions newer than 20.3.3 and 21.2.0
- Review and restrict network access to Java applications where possible
- Audit keystore files and certificate stores for unauthorized modifications
- Apply vendor patches for affected NetApp, Fedora, and Debian systems
Patch Information
Oracle released security patches addressing this vulnerability as part of the Oracle Critical Patch Update - October 2021. Organizations should upgrade to the following minimum versions:
- Java SE 7u321 or later
- Java SE 8u311 or later
- Java SE 11.0.13 or later
- Java SE 17.0.1 or later
- Oracle GraalVM Enterprise Edition 20.3.4 or later
- Oracle GraalVM Enterprise Edition 21.3.0 or later
Additional patches are available from distribution vendors:
- Debian Security Advisory DSA-5000
- Debian Security Advisory DSA-5012
- NetApp Security Advisory NTAP-20211022-0004
Workarounds
- Restrict network access to Java applications to trusted sources only
- Implement application-level access controls for Keytool operations
- Disable Java Web Start and Java applets where not required
- Use network segmentation to isolate Java-based services from untrusted networks
- Deploy web application firewalls to filter malicious requests to Java services
# Example: Restrict network access to Java services using firewall rules
# Allow Java application access only from trusted networks
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
# Verify Java version to confirm patched version is installed
java -version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
