CVE-2022-21619: Oracle GraalVM Auth Bypass Vulnerability

CVE-2022-21619 Overview

CVE-2022-21619 is a security vulnerability affecting the Security component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise affected Java deployments, potentially resulting in unauthorized modification of accessible data.

Critical Impact

Successful exploitation enables unauthorized update, insert, or delete access to some Oracle Java SE and Oracle GraalVM Enterprise Edition accessible data, though exploitation requires high attack complexity.

Affected Products

• Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19
• Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3, 22.2.0
• Fedora: 35, 36
• NetApp 7-Mode Transition Tool
• NetApp Cloud Insights Acquisition Unit
• NetApp Cloud Secure Agent
• NetApp E-Series SANtricity OS Controller (including version 11.70.2)
• NetApp E-Series SANtricity Storage Manager
• NetApp E-Series SANtricity Unified Manager
• NetApp OnCommand Insight
• NetApp OnCommand Workflow Automation
• NetApp SANtricity Storage Plugin for vCenter
• NetApp SANtricity Web Services Proxy
• Azul Zulu: 7.56, 8.64, 11.58, 13.50, 15.42, 17.36, 19.28

Discovery Timeline

• October 18, 2022 - CVE-2022-21619 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-21619

Vulnerability Analysis

This vulnerability resides in the Security component of Oracle Java SE and Oracle GraalVM Enterprise Edition. The flaw primarily impacts Java deployments where sandboxed Java Web Start applications or sandboxed Java applets load and execute untrusted code from external sources such as the internet, relying on the Java sandbox for security enforcement.

The vulnerability can also be exploited through APIs in the Security component, including scenarios where a web service supplies data to vulnerable APIs. This dual attack surface—both through sandboxed applications and direct API interaction—increases the potential exposure across enterprise environments.

While the vulnerability requires high attack complexity to exploit successfully, the network-based attack vector means no physical or local access is required. An unauthenticated attacker can attempt exploitation remotely, though the difficult nature of the exploit provides some inherent protection.

Root Cause

The vulnerability stems from an unspecified weakness in the Security component of Oracle Java SE and GraalVM Enterprise Edition. Oracle has classified this as having insufficient information available for detailed CWE categorization (NVD-CWE-noinfo). The flaw affects the integrity of data accessible through the vulnerable component, allowing unauthorized modifications when successfully exploited.

Attack Vector

The attack leverages network access via multiple protocols to target the Security component. Exploitation scenarios include:

1. Sandboxed Application Attack: An attacker delivers malicious code through a sandboxed Java Web Start application or Java applet that users download and execute, bypassing intended sandbox restrictions.

2. API-Based Attack: An attacker provides specially crafted data to web services that utilize the vulnerable Security component APIs, manipulating the service to perform unauthorized data modifications.

The network-based nature of the attack means remote exploitation is possible, though the high complexity requirement indicates specific conditions must be met for successful exploitation. No user interaction is required for the attack, and no privileges are needed by the attacker.

Detection Methods for CVE-2022-21619

Indicators of Compromise

• Unexpected modifications to data in Java-based applications without corresponding authorized transactions
• Unusual network traffic patterns targeting Java Web Start or applet endpoints
• Anomalous API calls to Java Security component functions from untrusted sources
• Log entries indicating failed or successful exploitation attempts against sandboxed Java applications

Detection Strategies

• Monitor for unusual Java applet or Web Start application activity, particularly from untrusted sources
• Implement application-level logging to track data modification operations in Java-based services
• Deploy network intrusion detection systems (NIDS) with signatures for known Java exploitation patterns
• Enable Java security logging to capture authentication and authorization events

Monitoring Recommendations

• Review Java application logs regularly for unauthorized data access or modification attempts
• Implement file integrity monitoring on critical Java configuration and security policy files
• Monitor outbound connections from Java applications for unusual communication patterns
• Track Java version deployments across the enterprise to ensure vulnerable versions are identified

How to Mitigate CVE-2022-21619

Immediate Actions Required

• Upgrade Oracle Java SE to the latest patched version from the October 2022 Critical Patch Update
• Update Oracle GraalVM Enterprise Edition to versions released after October 2022
• Review and restrict Java Web Start and applet usage in enterprise environments
• Implement network segmentation to limit exposure of systems running vulnerable Java versions

Patch Information

Oracle addressed this vulnerability in the October 2022 Critical Patch Update. Organizations should apply patches from the Oracle Security Alert October 2022. Additional patches are available for downstream products including:

• Fedora updates available via Fedora Package Announcements
• NetApp advisory available at NetApp Security Advisory NTAP-20221028-0012
• Gentoo users should reference GLSA 202401-25
• Azul Zulu users should update to the latest supported version for their Java release line

Workarounds

• Disable Java Web Start and Java applets if not required for business operations
• Implement strict network access controls to limit exposure of Java-based services
• Configure Java Security Manager policies to restrict untrusted code execution
• Use application firewalls to filter and inspect traffic destined for Java web services

# Example: Disable Java Web Start association (Windows)
# Remove .jnlp file association to prevent automatic execution
assoc .jnlp=

# Example: Restrict Java security policy
# Add to java.security file to limit code execution permissions
# Edit: $JAVA_HOME/conf/security/java.security
# Uncomment and configure: java.security.policy==/path/to/restrictive.policy