CVE-2022-23437: Apache Xerces-j DOS Vulnerability

CVE-2022-23437 Overview

CVE-2022-23437 is a Denial of Service vulnerability within the Apache Xerces Java (XercesJ) XML parser that occurs when handling specially crafted XML document payloads. When exploited, this vulnerability causes the XercesJ XML parser to enter an infinite loop, which may consume system resources for prolonged durations. This vulnerability affects XercesJ version 2.12.1 and all previous versions, impacting a wide range of enterprise applications that rely on this widely-used XML parsing library.

Critical Impact

Attackers can craft malicious XML documents that trigger an infinite loop in the parser, leading to resource exhaustion and denial of service conditions affecting application availability.

Affected Products

• Apache Xerces-J (versions up to and including 2.12.1)
• Oracle WebLogic Server (versions 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
• Oracle PeopleSoft Enterprise PeopleTools (versions 8.58, 8.59)
• Oracle Primavera Gateway (multiple versions)
• Oracle Financial Services Analytical Applications Infrastructure
• Oracle Communications Element Manager
• NetApp Active IQ Unified Manager for Windows

Discovery Timeline

• January 24, 2022 - CVE-2022-23437 published to NVD
• April 2022 - Oracle releases security patches in CPU April 2022
• July 2022 - Oracle releases additional patches in CPU July 2022
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-23437

Vulnerability Analysis

This vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop vulnerability. The flaw exists in how the Apache Xerces-J XML parser processes certain XML document structures. When the parser encounters a specially crafted XML payload, it enters a loop that never terminates due to an unreachable exit condition.

The vulnerability can be triggered remotely through network-accessible services that accept and parse XML input using the vulnerable Xerces-J library. User interaction is required in the sense that a victim application must process the attacker-supplied XML document. The attack does not compromise data confidentiality or integrity but severely impacts system availability.

Root Cause

The root cause of CVE-2022-23437 lies in improper loop termination logic within the XML parsing routines of Apache Xerces-J. When processing specific XML document structures, the parser's internal state machine fails to reach an exit condition, resulting in an infinite loop. This causes the parsing thread to continue execution indefinitely, consuming CPU cycles and potentially memory resources until the process is manually terminated or the system becomes unresponsive.

Attack Vector

The attack vector for this vulnerability is network-based, allowing remote exploitation. An attacker can exploit this vulnerability by sending a specially crafted XML document to any application or service that uses Apache Xerces-J for XML parsing. Common attack scenarios include:

The attacker crafts a malicious XML document designed to trigger the infinite loop condition within the parser. This document is then submitted to a vulnerable application through standard XML processing endpoints such as web service APIs, file upload functionality, or any other XML input mechanism.

Upon processing the malicious XML, the XercesJ parser enters the infinite loop, causing the application to become unresponsive. Depending on the application architecture, this may affect a single request handler thread or potentially the entire application if thread pool resources are exhausted.

Detection Methods for CVE-2022-23437

Indicators of Compromise

• Abnormally high CPU utilization by Java processes running applications that parse XML
• Application threads stuck in XML parsing operations for extended periods
• Thread dumps showing threads blocked in Xerces-J parsing methods
• Increased application response times or timeouts when processing XML input

Detection Strategies

• Monitor Java application thread states for threads that remain in RUNNABLE state within Xerces parsing methods for abnormal durations
• Implement application-level logging to track XML parsing operation durations and alert on excessive processing times
• Use application performance monitoring (APM) tools to detect CPU consumption anomalies in XML processing components
• Scan application dependencies to identify vulnerable versions of Apache Xerces-J (version 2.12.1 and earlier)

Monitoring Recommendations

• Configure alerts for sustained high CPU usage patterns in Java application servers
• Implement XML parsing timeouts at the application level to prevent indefinite processing
• Monitor thread pool health metrics for evidence of thread exhaustion
• Track application availability metrics and set up alerting for service degradation patterns consistent with DoS attacks

How to Mitigate CVE-2022-23437

Immediate Actions Required

• Inventory all applications using Apache Xerces-J and identify vulnerable versions
• Update Apache Xerces-J to version 2.12.2 or later where the vulnerability has been fixed
• Apply relevant Oracle Critical Patch Updates for affected Oracle products
• Implement XML parsing timeouts as a defensive measure until patches can be applied

Patch Information

Apache has addressed this vulnerability in Xerces-J version 2.12.2 and later. Organizations using affected Oracle products should apply the security patches from Oracle's April 2022 Critical Patch Update or July 2022 Critical Patch Update depending on the specific product. NetApp has also released patches for affected products as documented in their Security Advisory.

For detailed information about the vulnerability, refer to the Apache Mailing List Thread and the Openwall OSS Security Update.

Workarounds

• Implement XML parsing timeouts to automatically terminate parsing operations that exceed reasonable durations
• Use input validation to reject potentially malicious XML documents before parsing
• Deploy web application firewalls (WAF) with XML inspection capabilities to filter malicious payloads
• Consider isolating XML parsing operations in separate thread pools to prevent DoS from affecting the entire application

# Maven dependency update example
# Update pom.xml to use patched version
# Change:
#   <dependency>
#     <groupId>xerces</groupId>
#     <artifactId>xercesImpl</artifactId>
#     <version>2.12.1</version>
#   </dependency>
# To:
#   <dependency>
#     <groupId>xerces</groupId>
#     <artifactId>xercesImpl</artifactId>
#     <version>2.12.2</version>
#   </dependency>