CVE-2023-22067: Oracle JDK Auth Bypass Vulnerability

CVE-2023-22067 Overview

CVE-2023-22067 affects the Common Object Request Broker Architecture (CORBA) component of Oracle Java SE and Oracle GraalVM Enterprise Edition. The flaw allows an unauthenticated attacker with network access via CORBA to compromise integrity of accessible data. Successful exploitation can result in unauthorized update, insert, or delete access to a subset of data managed by the affected Java runtime. The vulnerability is tracked under [CWE-863] (Incorrect Authorization) and is exploitable only by supplying data to APIs in the CORBA component, such as through a web service, without requiring untrusted Java Web Start applications or applets.

Critical Impact

Unauthenticated network attackers can tamper with data processed through CORBA APIs in affected Oracle Java SE and GraalVM Enterprise Edition releases.

Affected Products

• Oracle Java SE: 8u381, 8u381-perf
• Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7
• NetApp Cloud Insights Acquisition Unit and Storage Workload Security Agent (bundled Java runtime)

Discovery Timeline

• 2023-10-17 - Oracle publishes the October 2023 Critical Patch Update containing the fix
• 2023-10-17 - CVE-2023-22067 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2023-22067

Vulnerability Analysis

The vulnerability resides in the CORBA subsystem of the Java runtime. CORBA is a legacy distributed object protocol that allows remote method invocation across processes and hosts. The flaw enables a remote attacker to send crafted requests to applications that expose CORBA endpoints or APIs that internally invoke CORBA functionality. According to Oracle's advisory, exploitation yields integrity-only impact, meaning the attacker can modify a subset of data accessible to the runtime but cannot read sensitive information or crash the service.

The attack does not require credentials or user interaction. Confidentiality and availability are not affected, and the scope is unchanged. EPSS data places the exploit probability at 0.172% (percentile 38.26), reflecting low observed exploitation activity to date.

Root Cause

The root cause is improper authorization within the CORBA component, mapped to [CWE-863]. The runtime fails to enforce expected access controls when processing certain CORBA-supplied data, allowing an attacker-influenced request to perform write operations that should have been blocked. Oracle has not published low-level technical details beyond the advisory text.

Attack Vector

The attack vector is network-based with low complexity. An attacker must reach an application or service that consumes CORBA inputs, for example a web service that forwards parameters to CORBA APIs in the affected Java runtime. The attacker submits crafted data to those APIs to trigger the integrity violation. Untrusted Java Web Start applications and untrusted applets are explicitly out of scope for this flaw.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed technical mechanics are not disclosed in the Oracle Critical Patch Update October 2023 advisory.

Detection Methods for CVE-2023-22067

Indicators of Compromise

• Unexpected modifications to records, configuration objects, or stored state in applications that route input to CORBA APIs.
• Inbound traffic to IIOP/GIOP listener ports (commonly 1050, 1099, 3528, or custom ORB ports) from untrusted networks.
• Java processes running vulnerable versions (1.8.0_381, GraalVM EE 20.3.11, 21.3.7) accepting external CORBA invocations.

Detection Strategies

• Inventory Java runtimes across servers and containers and flag any installation matching the affected versions listed in the Oracle and NetApp Security Advisory NTAP-20231027-0006.
• Inspect application code and deployment descriptors for org.omg.CORBA, com.sun.corba, or IIOP listener configurations that expose CORBA to network clients.
• Correlate web service request logs with downstream CORBA invocations to identify anomalous parameter patterns that produce write operations.

Monitoring Recommendations

• Alert on JVM processes that bind to IIOP/GIOP ports on internet-facing interfaces.
• Monitor data stores for unauthorized write operations originating from Java application service accounts during periods without legitimate activity.
• Track Java patch posture across endpoints and servers to ensure vulnerable builds are replaced after deployment.

How to Mitigate CVE-2023-22067

Immediate Actions Required

• Upgrade Oracle Java SE and Oracle GraalVM Enterprise Edition to the fixed versions listed in the Oracle Critical Patch Update October 2023.
• Apply the corresponding NetApp updates for Cloud Insights Acquisition Unit and Storage Workload Security Agent per NetApp Security Advisory NTAP-20231027-0006 and the follow-up NTAP-20241108-0002.
• On Debian systems, install the OpenJDK updates documented in Debian Security Advisory DSA-5537.

Patch Information

Oracle delivered the fix in the October 2023 Critical Patch Update. Administrators should move off Java SE 8u381 / 8u381-perf and GraalVM Enterprise Edition 20.3.11 and 21.3.7 to the patched releases referenced in the Oracle CPU advisory. Downstream vendors including NetApp and Debian have republished the fix in their respective product builds.

Workarounds

• Restrict network exposure of CORBA/IIOP listeners to trusted management networks using firewall rules or host-based access controls.
• Disable CORBA features in applications that do not require them and remove any web service endpoints that proxy untrusted input to CORBA APIs.
• If patching is delayed, place affected services behind an authenticating reverse proxy that rejects unauthenticated requests to CORBA-backed endpoints.

# Verify the installed Java version and replace if it matches the affected builds
java -version
# Example output to remediate: openjdk version "1.8.0_381"

# Restrict IIOP/GIOP exposure at the host firewall (Linux example)
iptables -A INPUT -p tcp --dport 1050 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1050 -j DROP