CVE-2022-21618: Oracle GraalVM Auth Bypass Vulnerability

CVE-2022-21618 Overview

CVE-2022-21618 is a vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products, specifically affecting the JGSS (Java Generic Security Services) component. This easily exploitable vulnerability allows an unauthenticated attacker with network access via the Kerberos protocol to compromise affected Java installations. Successful exploitation can result in unauthorized update, insert, or delete access to some of the accessible data within Oracle Java SE and Oracle GraalVM Enterprise Edition environments.

Critical Impact

Unauthenticated attackers can exploit this vulnerability remotely via Kerberos to modify data in Java deployments, particularly affecting sandboxed Java Web Start applications, Java applets, and web services that utilize the JGSS APIs.

Affected Products

• Oracle Java SE: 17.0.4.1, 19
• Oracle GraalVM Enterprise Edition: 21.3.3, 22.2.0
• Oracle JDK: 17.0.4.1, 19
• Oracle JRE: 17.0.4.1, 19
• Fedora Project Fedora: 35, 36
• NetApp 7-Mode Transition Tool
• NetApp Cloud Insights Acquisition Unit
• NetApp Cloud Secure Agent
• NetApp E-Series SANtricity OS Controller
• NetApp E-Series SANtricity Storage Manager
• NetApp E-Series SANtricity Unified Manager
• NetApp OnCommand Insight
• NetApp OnCommand Workflow Automation
• NetApp SANtricity Storage Plugin
• Azul Zulu: 11.58, 13.50, 15.42, 17.36, 19.28

Discovery Timeline

• 2022-10-18 - CVE-2022-21618 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21618

Vulnerability Analysis

This vulnerability resides in the JGSS (Java Generic Security Services) component of Oracle Java SE and Oracle GraalVM Enterprise Edition. The JGSS API provides a uniform interface for accessing different security mechanisms, with Kerberos being the primary mechanism implemented. The flaw allows unauthenticated attackers to exploit the vulnerability through network-based attacks using the Kerberos authentication protocol.

The vulnerability primarily impacts data integrity, enabling attackers to perform unauthorized modifications to accessible data. While confidentiality and availability are not directly compromised, the ability to modify data without authentication poses significant security risks in enterprise environments where Java applications handle sensitive business logic.

This vulnerability applies to multiple deployment scenarios:

• Client-side Java deployments running sandboxed Java Web Start applications
• Sandboxed Java applets that load and run untrusted code from the internet
• Server-side deployments where web services supply data to the JGSS APIs

Root Cause

The root cause stems from improper input validation or security checks within the JGSS component when processing Kerberos authentication requests. The vulnerability allows attackers to bypass expected security controls and modify data that should be protected by the Java sandbox or Kerberos authentication mechanisms.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the target system via the Kerberos protocol. The attack complexity is low, requiring no privileges or user interaction, making it relatively straightforward for attackers to exploit in environments where affected Java versions are deployed and Kerberos authentication is in use.

Exploitation can occur through:

• Direct attacks against Java Web Start applications that process untrusted code
• Malicious Java applets delivered through web browsers
• Crafted requests to web services that utilize JGSS APIs for authentication

Detection Methods for CVE-2022-21618

Indicators of Compromise

• Unexpected modifications to data protected by Kerberos authentication in Java applications
• Anomalous Kerberos ticket requests or authentication patterns targeting Java services
• Unusual network traffic patterns on Kerberos ports (typically TCP/UDP 88) directed at Java application servers
• Java process logs showing unexpected JGSS API invocations from untrusted sources

Detection Strategies

• Monitor Kerberos authentication logs for unusual ticket-granting ticket (TGT) requests or service ticket requests targeting Java applications
• Implement network intrusion detection rules to identify malformed or suspicious Kerberos protocol traffic
• Review Java application logs for unexpected JGSS component errors or authentication anomalies
• Deploy endpoint detection to identify Java processes executing with vulnerable runtime versions

Monitoring Recommendations

• Enable verbose logging for JGSS and Kerberos components in Java applications to capture authentication events
• Implement data integrity monitoring for databases and files accessed by Java applications using Kerberos authentication
• Set up alerts for Java runtime version inventories to identify systems running affected versions (17.0.4.1, 19, GraalVM 21.3.3, 22.2.0)
• Monitor for Java applet and Web Start execution in browser environments where these technologies are still enabled

How to Mitigate CVE-2022-21618

Immediate Actions Required

• Upgrade Oracle Java SE to version 17.0.5 or later, or Java 20 or later
• Upgrade Oracle GraalVM Enterprise Edition to version 21.3.4 or later, or 22.3.0 or later
• For Azul Zulu users, upgrade to the latest patched versions as specified in Azul security advisories
• Audit all systems running Java applications that utilize Kerberos authentication to identify affected deployments

Patch Information

Oracle has addressed this vulnerability in the October 2022 Critical Patch Update. Organizations should apply the appropriate patches based on their Java distribution:

• Oracle JDK/JRE: Update to the latest version from Oracle's official download portal
• Fedora: Apply updates from the Fedora package repositories as announced in the Fedora Package Announcements
• NetApp Products: Refer to the NetApp Security Advisory for product-specific guidance
• Gentoo Linux: Apply updates per GLSA 202401-25
• Azul Zulu: Update to patched versions for your LTS stream

Workarounds

• Disable Java Web Start and Java browser plugins where not operationally required to reduce the attack surface
• Implement network segmentation to restrict Kerberos traffic to only authorized systems and services
• Configure application firewalls to filter malicious Kerberos protocol traffic targeting Java services
• For web services using JGSS APIs, implement additional input validation and access controls at the application layer

# Configuration example
# Check current Java version to identify vulnerable installations
java -version

# For systems using alternatives (Linux), update to patched Java version
sudo alternatives --config java

# Disable Java plugin in browser (if applicable)
# Remove or disable Java Web Start associations
# Firefox: about:config -> plugin.state.java = 0

# Verify JGSS/Kerberos configuration
# Review krb5.conf for proper security settings
cat /etc/krb5.conf