CVE-2022-21282: Oracle GraalVM Information Disclosure Bug

CVE-2022-21282 Overview

CVE-2022-21282 is an information disclosure vulnerability affecting the JAXP (Java API for XML Processing) component in Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access to compromise affected systems via multiple protocols, potentially gaining unauthorized read access to a subset of accessible data.

The vulnerability primarily impacts Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from external sources (such as internet-hosted content) and rely on the Java sandbox for security isolation. Additionally, this vulnerability can be exploited through APIs in the JAXP component, including scenarios where a web service supplies malicious data to these APIs.

Critical Impact

Unauthenticated remote attackers can exploit this JAXP vulnerability to gain unauthorized read access to sensitive data in Java SE and GraalVM environments without user interaction.

Affected Products

• Oracle Java SE 7u321, 8u311, 11.0.13, 17.0.1
• Oracle GraalVM Enterprise Edition 20.3.4 and 21.3.0
• Oracle OpenJDK 7, 8, 11, and 17 (multiple updates)
• Debian Linux 9.0, 10.0, 11.0
• NetApp Active IQ Unified Manager, Cloud Insights Acquisition Unit, Cloud Secure Agent
• NetApp E-Series SANtricity products (OS Controller, Storage Manager, Web Services)
• NetApp OnCommand Insight, OnCommand Workflow Automation, SnapManager

Discovery Timeline

• 2022-01-19 - CVE-2022-21282 published to NVD
• 2022-01-18 - Oracle releases security patch in January 2022 Critical Patch Update
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21282

Vulnerability Analysis

This vulnerability resides in the JAXP (Java API for XML Processing) component of Oracle Java SE and GraalVM Enterprise Edition. JAXP provides a standardized interface for processing XML documents using DOM, SAX, and XSLT parsers in Java applications. The flaw allows attackers to exploit XML processing functionality to extract sensitive information from the target system.

The vulnerability is easily exploitable and does not require any privileges or user interaction to trigger. An attacker can leverage network access through multiple protocols to reach vulnerable JAXP APIs. The successful exploitation results in confidentiality impact only—allowing unauthorized read access to a subset of data accessible to the compromised Java runtime environment.

This issue particularly affects client-side Java deployments that execute untrusted code within the Java sandbox security model. Web applications and services that accept and process XML data through JAXP APIs are also at risk, as malicious input can be crafted to trigger the vulnerability through these interfaces.

Root Cause

The vulnerability stems from improper handling within the JAXP component when processing XML data. The specific weakness allows external actors to bypass security restrictions and access data that should be protected by the Java sandbox or application-level security controls. The root cause has not been fully disclosed by Oracle beyond its classification as an information disclosure issue in JAXP.

Attack Vector

Exploitation occurs remotely over the network without requiring authentication. An attacker can exploit this vulnerability through several attack scenarios:

1. Client-side exploitation: By hosting malicious code on the internet and enticing users to run it as a sandboxed Java Web Start application or Java applet
2. Server-side exploitation: By sending crafted XML payloads to web services or applications that use JAXP APIs to process the attacker-controlled data
3. API abuse: By directly calling exposed JAXP component APIs with specially crafted input designed to trigger the information disclosure

The attack does not require any privileges on the target system, and no user interaction is needed beyond the initial loading of untrusted content in client-side scenarios.

Detection Methods for CVE-2022-21282

Indicators of Compromise

• Unusual XML parsing activity or errors in Java application logs indicating potential exploitation attempts
• Network traffic containing suspicious XML payloads targeting Java-based web services
• Unexpected data access patterns from Java processes, particularly involving JAXP-related operations
• Evidence of untrusted Java Web Start applications or applets being executed in the environment

Detection Strategies

• Monitor Java application logs for abnormal JAXP processing errors or exceptions that may indicate exploitation attempts
• Implement network-level inspection for suspicious XML payloads targeting Java services
• Deploy SentinelOne Singularity Platform to detect anomalous Java process behavior and potential information exfiltration
• Track Java runtime versions across the environment to identify unpatched systems vulnerable to CVE-2022-21282

Monitoring Recommendations

• Enable verbose logging for Java applications processing XML data to capture potential exploitation indicators
• Configure network monitoring to alert on unusual outbound data transfers from Java processes
• Implement application-level monitoring for JAXP API usage patterns that deviate from established baselines
• Use SentinelOne's behavioral AI to detect anomalous activity associated with Java runtime exploitation

How to Mitigate CVE-2022-21282

Immediate Actions Required

• Update Oracle Java SE to versions 7u331, 8u321, 11.0.14, or 17.0.2 and later
• Upgrade Oracle GraalVM Enterprise Edition to patched versions released after January 2022
• Apply vendor-specific patches for affected NetApp and Debian products
• Disable Java Web Start and Java applets in browser environments where feasible
• Review and restrict network access to Java-based web services processing external XML data

Patch Information

Oracle addressed this vulnerability in the January 2022 Critical Patch Update (CPU). The patch is available through Oracle's standard software distribution channels. Organizations should apply updates according to their Java distribution:

• Oracle JDK/JRE: Download updated versions from Oracle's Java SE Downloads page
• OpenJDK: Obtain patched versions from the OpenJDK project or your Linux distribution
• GraalVM Enterprise Edition: Update through Oracle support channels

Additional vendor advisories and patches are available from Debian Security Advisory DSA-5057, Debian Security Advisory DSA-5058, and NetApp Security Advisory NTAP-20220121-0007.

For complete details, refer to the Oracle January 2022 CPU Security Alert.

Workarounds

• Restrict execution of untrusted Java Web Start applications and applets by configuring Java security settings
• Implement strict input validation and sanitization for XML data processed through JAXP APIs
• Deploy network segmentation to limit exposure of Java-based services to untrusted networks
• Configure Java Security Manager with restrictive policies to limit potential impact of exploitation

# Verify Java version to confirm patching status
java -version

# Check for vulnerable Java installations across systems
find / -name "java" -type f -exec {} -version 2>&1 \; | grep -E "1\.(7\.0_3[0-2][0-1]|8\.0_3[0-1][0-1])|11\.0\.1[0-3]|17\.0\.[0-1]"

# Disable Java Web Start and Applet support in deployment.properties
echo "deployment.webjava.enabled=false" >> ~/.java/deployment/deployment.properties