CVE-2022-21248: Oracle GraalVM Auth Bypass Vulnerability

CVE-2022-21248 Overview

CVE-2022-21248 is a serialization vulnerability affecting Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability resides in the Serialization component and allows an unauthenticated attacker with network access via multiple protocols to compromise affected Java installations. While difficult to exploit, successful attacks can result in unauthorized update, insert, or delete access to some accessible data within the affected products.

This vulnerability is particularly concerning for Java deployments that run sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from the internet. The vulnerability can also be exploited through APIs in the Serialization component, such as through web services that supply data to these APIs.

Critical Impact

Unauthenticated attackers can potentially manipulate data integrity in Java applications through the Serialization component, affecting both client-side applets and server-side web services.

Affected Products

• Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1
• Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0
• Oracle OpenJDK (multiple versions through 17.0.1)
• NetApp products including Active IQ Unified Manager, OnCommand Insight, SnapManager
• Debian Linux 9.0, 10.0, 11.0
• Fedora 34 and 35

Discovery Timeline

• January 19, 2022 - CVE-2022-21248 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-21248

Vulnerability Analysis

This vulnerability exists in the Serialization component of Oracle Java SE and Oracle GraalVM Enterprise Edition. The flaw allows an unauthenticated attacker to potentially modify data through improper handling of serialized objects. The vulnerability requires network access and is considered difficult to exploit due to the specific conditions needed for successful exploitation.

The impact is limited to data integrity—successful exploitation does not provide attackers with the ability to read confidential data or cause a denial of service condition. However, the ability to modify data without authorization can have significant implications for applications relying on data integrity, particularly in enterprise environments where Java applications handle sensitive business logic.

Root Cause

The root cause stems from improper handling within the Java Serialization mechanism. Java's serialization functionality converts objects into byte streams for storage or transmission, and this vulnerability allows manipulation of that process. While the specific technical details have not been fully disclosed, the flaw affects how the Serialization component processes certain types of input, potentially allowing attackers to inject or modify serialized data.

Attack Vector

The attack vector is network-based, meaning attackers can exploit this vulnerability remotely without requiring authentication. The exploitation primarily targets:

1. Client-side deployments: Sandboxed Java Web Start applications and Java applets that load untrusted code from the internet
2. Server-side deployments: Web services and APIs that utilize the Serialization component to process incoming data

An attacker would need to craft malicious serialized data and deliver it to a vulnerable Java application. The difficulty of exploitation stems from the need to bypass Java's sandbox security model and the specific conditions required for successful data manipulation.

The vulnerability does not involve arbitrary code execution, but rather allows unauthorized data modification operations (insert, update, delete) on data accessible to the compromised Java application.

Detection Methods for CVE-2022-21248

Indicators of Compromise

• Unusual serialization-related exceptions or errors in Java application logs
• Unexpected data modifications in applications using Java serialization
• Anomalous network traffic patterns involving serialized Java objects
• Java applications receiving malformed or suspicious serialized data streams

Detection Strategies

• Monitor Java application logs for serialization-related errors or unusual deserialization activities
• Implement network traffic analysis to detect anomalous serialized object transfers
• Deploy application-level monitoring for unexpected data changes in Java-based systems
• Use SentinelOne's behavioral AI to detect exploitation attempts targeting Java applications

Monitoring Recommendations

• Enable detailed logging for Java applications, particularly around serialization operations
• Monitor for unusual network connections to Java-based services from untrusted sources
• Implement integrity monitoring for data stores accessed by vulnerable Java applications
• Track Java version deployments across your environment to identify unpatched systems

How to Mitigate CVE-2022-21248

Immediate Actions Required

• Update Oracle Java SE to the latest patched versions released in the January 2022 Critical Patch Update
• Upgrade Oracle GraalVM Enterprise Edition to versions newer than 20.3.4 and 21.3.0
• Update OpenJDK installations to the latest available security releases
• Review and restrict network access to Java-based applications where possible

Patch Information

Oracle released patches addressing this vulnerability as part of the Oracle Critical Patch Update January 2022. Organizations should upgrade to the following minimum versions or later:

• Java SE 7: Update 331 or later
• Java SE 8: Update 321 or later
• Java SE 11: 11.0.14 or later
• Java SE 17: 17.0.2 or later
• GraalVM Enterprise Edition: Versions after 20.3.4 and 21.3.0

Additional security advisories have been issued by:

• Debian Security Advisory DSA-5057
• Debian Security Advisory DSA-5058
• NetApp Security Advisory NTAP-20220121-0007
• Gentoo GLSA 202209-05

Workarounds

• Disable Java Web Start and Java applets in browser settings if not required
• Implement network segmentation to limit access to Java-based services
• Configure serialization filters using jdk.serialFilter to restrict deserialization of untrusted data
• Avoid processing serialized data from untrusted sources where possible

# Example: Configure serialization filter in Java application
# Add to java command line or java.security file
-Djdk.serialFilter=maxdepth=5;maxrefs=10000;maxbytes=500000;!*