CVE-2022-0866: JBoss EAP Privilege Escalation Vulnerability

CVE-2022-0866 Overview

CVE-2022-0866 is a race condition vulnerability affecting JBoss Enterprise Application Platform (EAP) and WildFly application servers. The vulnerability exists in the Enterprise JavaBeans (EJB) component when configured with a RunAs principal and Elytron security is enabled. Due to improper handling of concurrent requests, an attacker could potentially access resources with incorrect caller principal information, leading to unauthorized access or information disclosure.

Critical Impact

In concurrent environments where multiple users invoke EJBs configured with RunAs principals, the wrong caller principal may be returned, potentially allowing unauthorized access to sensitive resources or incorrect role-based authorization decisions.

Affected Products

• Red Hat JBoss Enterprise Application Platform 7.1.0 and later versions
• Red Hat WildFly 11+ when Elytron is enabled
• Red Hat OpenStack Platform 13.0

Discovery Timeline

• 2022-05-10 - CVE-2022-0866 published to NVD
• 2025-11-06 - Last updated in NVD database

Technical Details for CVE-2022-0866

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization) and represents a race condition in the EJB security context handling. The flaw resides in the org.jboss.as.ejb3.component.EJBComponent class, specifically in how the incomingRunAsIdentity field manages security identities during concurrent EJB invocations.

The vulnerability enables attackers to potentially bypass authorization controls in multi-threaded environments where EJBs are configured with RunAs principals. When multiple users simultaneously invoke an affected EJB, the system may return incorrect caller principal information, leading to authorization decisions being made based on the wrong user identity.

Root Cause

The root cause stems from a thread-safety issue in the EJBComponent#incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to track the current identity before switching to a new identity created using the RunAs principal. Because incomingRunAsIdentity is stored as a simple SecurityIdentity object without proper synchronization, concurrent access can result in one thread reading another thread's identity information.

The methods EJBComponent#getCallerPrincipal and EJBComponent#isCallerInRole both rely on this field, meaning incorrect identity information can affect both principal retrieval and role membership checks.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication to trigger. An attacker can exploit this vulnerability by:

1. Identifying an EJB endpoint configured with a RunAs principal
2. Generating a high volume of concurrent requests to the target EJB
3. Exploiting the race condition to have their request processed with another user's principal
4. Accessing resources or performing actions based on the incorrectly assigned identity

The vulnerability manifests in the EJBComponent class where the incomingRunAsIdentity field lacks proper thread-safe handling during concurrent EJB invocations. When multiple threads access this field simultaneously, the RunAs principal interceptor may read or write stale identity information, causing getCallerPrincipal() to return an incorrect user identity. For detailed technical analysis, refer to the Red Hat Bug Report #2060929.

Detection Methods for CVE-2022-0866

Indicators of Compromise

• Unexpected access log entries showing users accessing resources they should not have permission to access
• Audit logs revealing authorization decisions made for incorrect principals
• Application logs containing inconsistent caller principal information during high-concurrency periods
• User reports of seeing another user's data or permissions

Detection Strategies

• Monitor EJB invocation logs for anomalies in caller principal assignments during high-load scenarios
• Implement application-level logging to track getCallerPrincipal() and isCallerInRole() results
• Deploy SentinelOne Singularity to detect unusual application behavior patterns
• Review access control audit trails for authorization decisions that don't match expected user permissions

Monitoring Recommendations

• Enable detailed EJB security logging in JBoss EAP and WildFly configurations
• Implement real-time monitoring of concurrent EJB invocation patterns
• Configure alerts for unusual spikes in EJB component activity
• Use application performance monitoring (APM) tools to track thread contention in EJB components

How to Mitigate CVE-2022-0866

Immediate Actions Required

• Review all EJB configurations to identify components using RunAs principals with Elytron security
• Assess whether affected applications operate in high-concurrency environments
• Implement additional application-level authorization checks as a defense-in-depth measure
• Consider temporarily disabling RunAs principal configurations on critical EJBs until patched

Patch Information

Red Hat has acknowledged this vulnerability and tracked it under Bug #2060929. Organizations should apply the latest security updates for JBoss EAP and WildFly from Red Hat's official channels. Check the Red Hat Customer Portal for specific patch versions addressing this CVE for your installed product version.

Workarounds

• Avoid using RunAs principal configurations in EJBs that handle sensitive operations under high concurrency
• Implement additional authorization validation at the business logic layer that does not rely solely on getCallerPrincipal()
• Consider using alternative security mechanisms that don't depend on the affected incomingRunAsIdentity field
• Reduce concurrent access to affected EJBs through load balancing or request throttling until patches can be applied

# Review EJB configurations for RunAs principals in standalone.xml or domain.xml
grep -r "run-as-principal" $JBOSS_HOME/standalone/configuration/
grep -r "RunAs" $JBOSS_HOME/standalone/deployments/*.ear

# Check if Elytron security subsystem is enabled
grep -A 5 "elytron" $JBOSS_HOME/standalone/configuration/standalone.xml