CVE-2022-21299: Oracle GraalVM Enterprise DoS Vulnerability

CVE-2022-21299 Overview

CVE-2022-21299 is a denial of service vulnerability in the JAXP (Java API for XML Processing) component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to cause a partial denial of service condition affecting the availability of affected Java deployments.

The vulnerability is particularly concerning for environments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from the internet. Additionally, the vulnerability can be exploited through APIs in the JAXP component, such as through web services that supply data to these APIs.

Critical Impact

Unauthenticated remote attackers can cause partial denial of service on affected Oracle Java SE and GraalVM Enterprise Edition deployments via network-accessible JAXP component exploitation.

Affected Products

• Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1
• Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0
• Oracle OpenJDK: Multiple versions through 7u321, 8u312, and 17.0.1
• Debian Linux: 9.0, 10.0, 11.0
• NetApp Products: Active IQ Unified Manager, Cloud Insights Acquisition Unit, Cloud Secure Agent, E-Series SANtricity products, HCI Management Node, OnCommand Insight, OnCommand Workflow Automation, SnapManager, and SolidFire

Discovery Timeline

• 2022-01-19 - CVE-2022-21299 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21299

Vulnerability Analysis

The vulnerability resides in the JAXP component of Oracle Java SE and GraalVM Enterprise Edition. JAXP provides a standard interface for parsing and transforming XML documents in Java applications. When processing specially crafted input, the JAXP component fails to properly handle certain conditions, allowing an attacker to consume excessive resources and cause a partial denial of service.

The attack requires no authentication and can be executed remotely over the network via multiple protocols. The exploitation complexity is low, making this vulnerability accessible to attackers with basic skills. While the vulnerability does not impact confidentiality or integrity, successful exploitation results in degraded availability of the affected Java runtime environment.

This vulnerability affects both client-side Java deployments (such as Java applets and Java Web Start applications that execute untrusted code within the Java sandbox) and server-side deployments that expose JAXP APIs through web services or other network-accessible interfaces.

Root Cause

The root cause lies in improper resource management within the JAXP XML processing component. When handling specific XML data patterns, the component does not adequately limit resource consumption, allowing maliciously crafted input to trigger resource exhaustion conditions. The Java sandbox, which normally provides security isolation for untrusted code, cannot prevent this denial of service condition because the vulnerability exists within the trusted JAXP implementation itself.

Attack Vector

The attack vector is network-based and can be exploited through multiple protocols. An attacker can target vulnerable systems by:

1. Sending malicious XML data to web services that utilize JAXP for XML parsing
2. Delivering specially crafted content to Java Web Start applications or applets
3. Exploiting any network-accessible endpoint that processes XML using the vulnerable JAXP component

The vulnerability requires no user interaction for exploitation in server-side scenarios, though client-side exploitation via applets or Web Start applications may require user action to load the malicious content.

The attack mechanism involves supplying crafted XML data that causes the JAXP parser to enter a resource-intensive processing state. When the parser encounters this malicious input, it fails to properly bound its resource utilization, resulting in degraded service availability. The partial denial of service condition persists until the malicious processing completes or the affected Java process is terminated.

Detection Methods for CVE-2022-21299

Indicators of Compromise

• Unusual spikes in CPU or memory utilization by Java processes, particularly those handling XML parsing
• Increased response times or timeouts from web services that process XML data via JAXP
• Java application logs showing excessive garbage collection or memory pressure during XML processing operations
• Network traffic containing abnormally large or deeply nested XML payloads targeting Java-based web services

Detection Strategies

• Monitor Java application performance metrics for anomalous resource consumption patterns during XML processing operations
• Implement intrusion detection rules to identify malformed or suspiciously structured XML payloads in network traffic
• Deploy application-layer monitoring to track JAXP API call patterns and detect unusual XML parsing behavior
• Configure SentinelOne Singularity to monitor Java process behavior for denial of service indicators

Monitoring Recommendations

• Enable detailed logging for JAXP XML parsing operations to capture processing anomalies
• Implement resource utilization alerts for Java Virtual Machine instances handling untrusted XML content
• Monitor web service endpoints that accept XML input for availability degradation patterns
• Track Java process health metrics including CPU usage, memory allocation, and thread activity

How to Mitigate CVE-2022-21299

Immediate Actions Required

• Update Oracle Java SE to versions 7u331, 8u321, 11.0.14, or 17.0.2 and later
• Upgrade Oracle GraalVM Enterprise Edition to patched versions as specified in the Oracle CPU January 2022 advisory
• Update Oracle OpenJDK installations to the latest available patched versions
• Review and restrict network access to Java-based web services that process XML until patching is complete

Patch Information

Oracle has addressed this vulnerability in the January 2022 Critical Patch Update (CPU). The official security advisory is available at Oracle CPU January 2022. Organizations using affected Java versions should apply the appropriate patches immediately.

For Linux distributions:

• Debian users should apply patches referenced in DSA-5057 and DSA-5058
• Gentoo users should refer to GLSA 202209-05
• NetApp customers should review NetApp Security Advisory ntap-20220121-0007

Workarounds

• Implement XML input validation and sanitization before processing with JAXP to reject malformed or suspicious content
• Deploy network-level filtering to limit XML payload sizes and complexity reaching Java applications
• Consider using XML parsing limits such as XMLConstants.FEATURE_SECURE_PROCESSING to constrain resource usage during parsing
• Isolate Java applications that must process untrusted XML content in resource-constrained environments

# Verify Java version to check if patching is required
java -version

# Example: Setting secure processing feature for JAXP parsers
# Add to Java application startup parameters
-Djdk.xml.entityExpansionLimit=100
-Djdk.xml.maxOccur=5000
-Djdk.xml.totalEntitySizeLimit=50000000