CVE-2021-22696

CWE-400 — Uncontrolled Resource ConsumptionCWE-918 — Server-Side Request Forgery (SSRF)6 documents6 sources
Severity
7.5HIGH
EPSS
2.0%
top 16.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Apache Software Foundation Apache CXFApache CXFOracle Communications Diameter Intelligence HUB+4 more
Timeline
PublishedApr 2
Latest updateOct 15

Description

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the para…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages9 packages

▶NVDapache/cxf3.4.0 — 3.4.3+1
▶Mavenorg.apache.cxf:cxf3.4.0 — 3.4.3+1
▶Mavenorg.apache.cxf:apache-cxf3.4.0 — 3.4.3+1
▶CVEListV5apache_software_foundation/apache_cxfunspecified — 3.4.3+1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
Authorization service vulnerable to DDos attacks in Apache CFX↗2021-05-13
▶
OSV
Authorization service vulnerable to DDos attacks in Apache CFX↗2021-05-13
▶
CVEList
OAuth 2 authorization service vulnerable to DDos attacks↗2021-04-02
▶

📋Vendor Advisories

2
Oracle
Oracle Oracle Communications Risk Matrix: Reports (Apache CXF) — CVE-2021-22696↗2021-10-15
▶
Red Hat
cxf: OAuth 2 authorization service vulnerable to DDos attacks↗2021-04-02
▶
CVE-2021-22696 (HIGH CVSS 7.5) | CXF supports (via JwtRequestCodeFil | cvebase.io