CVE-2022-21248: Oracle GraalVM Auth Bypass Vulnerability

CVE-2022-21248 Overview

CVE-2022-21248 is a serialization vulnerability affecting Oracle Java SE and Oracle GraalVM Enterprise Edition. The flaw resides in the Serialization component and allows an unauthenticated attacker with network access to compromise integrity of accessible data. Affected versions include Oracle Java SE 7u321, 8u311, 11.0.13, and 17.0.1, plus GraalVM Enterprise Edition 20.3.4 and 21.3.0. Successful exploitation enables unauthorized update, insert, or delete operations against some Java SE and GraalVM-accessible data. The vulnerability applies to Java deployments processing untrusted data, including sandboxed Java Web Start applications, sandboxed applets, and web services exposing APIs in the affected component.

Critical Impact
Network-reachable Java applications that deserialize or process untrusted input may experience unauthorized integrity changes to application data without requiring authentication.

Affected Products

Oracle Java SE 7u321, 8u311, 11.0.13, 17.0.1 (JDK and JRE)
Oracle GraalVM Enterprise Edition 20.3.4 and 21.3.0
Multiple NetApp products (Active IQ Unified Manager, OnCommand Insight, SnapManager, SolidFire, E-Series SANtricity), Debian Linux 9/10/11, Fedora 34/35, and Oracle OpenJDK builds

Discovery Timeline

2022-01-18 - Oracle releases the January 2022 Critical Patch Update addressing CVE-2022-21248
2022-01-19 - CVE-2022-21248 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21248

Vulnerability Analysis

The issue is an insecure deserialization weakness ([CWE-502] class behavior) in the Java SE Serialization subsystem. An attacker who can deliver crafted serialized data to a Java process — over RMI, HTTP, or any protocol that hands bytes to ObjectInputStream — can manipulate object state during reconstruction. The flaw is difficult to exploit because the attacker must satisfy specific runtime conditions, and the impact is constrained to integrity, with no confidentiality or availability impact. The vulnerability is reachable from clients running sandboxed Java Web Start applications or applets that load untrusted code, as well as from server-side APIs that accept serialized objects.

Root Cause

The root cause lies in how the Serialization component validates object graphs during reconstruction. Insufficient checks during deserialization allow attacker-controlled inputs to alter fields or invoke code paths that mutate data outside the expected contract. Because deserialization can drive object construction without invoking constructors, validation logic embedded in normal object instantiation is bypassed.

Attack Vector

Exploitation requires network access and no authentication, but high attack complexity. An attacker delivers a malicious serialized payload through any interface that feeds bytes to a vulnerable Java deserialization API. The payload alters state once reconstructed, producing unauthorized update, insert, or delete operations against data the Java process can reach. Web services that expose APIs accepting serialized input, RMI endpoints, and sandboxed clients that load remote code are the principal exposure surfaces.

No verified public proof-of-concept code is available for CVE-2022-21248. Refer to the Oracle January 2022 Security Alert for vendor-confirmed technical context.

Detection Methods for CVE-2022-21248

Indicators of Compromise

Unexpected modifications to application data sets handled by Java services with no corresponding authorized user action or audit trail
Inbound network traffic carrying Java serialized object magic bytes (AC ED 00 05) directed at endpoints not designed to accept serialized input
Java process logs showing ObjectInputStream.readObject exceptions, class resolution failures, or unexpected class loading from untrusted classpaths

Detection Strategies

Inventory all Java SE and GraalVM runtime versions across endpoints and servers, flagging instances matching the affected version list
Inspect application logs for deserialization exceptions and correlate with subsequent data integrity anomalies
Apply network signatures that identify Java serialized object streams traversing perimeter or internal segmentation boundaries on unexpected ports

Monitoring Recommendations

Enable JVM serialization filters (jdk.serialFilter) and monitor filter rejection events as detection signals
Track changes to database tables and application data stores accessed by Java services for unauthorized writes
Aggregate JVM and application telemetry into a centralized analytics platform for correlation across hosts

How to Mitigate CVE-2022-21248

Immediate Actions Required

Apply the Oracle January 2022 Critical Patch Update to all affected Java SE and GraalVM Enterprise Edition installations
Upgrade NetApp products per NetApp Security Advisory NTAP-20220121-0007
Update Debian and Fedora hosts using packages from Debian Security Advisory DSA-5057, DSA-5058, and the corresponding Fedora Package Announcements
Identify any service exposing ObjectInputStream to untrusted networks and restrict access pending patch deployment

Patch Information

Oracle addressed CVE-2022-21248 in the January 2022 Critical Patch Update. Fixed releases include Oracle Java SE 7u331, 8u321, 11.0.14, 17.0.2, and Oracle GraalVM Enterprise Edition 20.3.5 and 21.3.1. Downstream distributions shipped corresponding updates via Gentoo GLSA 202209-05 and the Debian LTS Advisory.

Workarounds

Configure a JVM-wide deserialization allowlist using jdk.serialFilter to restrict permitted classes during ObjectInputStream operations
Replace Java native serialization with safer data formats such as JSON or Protocol Buffers in inter-service APIs
Disable or remove Java Web Start and applet support from clients that no longer require it

bash

# Configuration example: enforce a process-wide serialization filter
java -Djdk.serialFilter='!*' -jar application.jar

# Or set a global filter in $JAVA_HOME/conf/security/java.security
# jdk.serialFilter=maxdepth=10;maxarray=10000;maxrefs=100;com.example.**;!*