Vulnerability Name:

CVE-2021-22696 (CCN-199335)

Assigned:2021-04-02
Published:2021-04-02
Updated:2022-05-12
Summary:CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-918
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2021-22696

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20210402 CVE-2021-22696: Apache CXF: OAuth 2 authorization service vulnerable to DDos attacks

Source: CCN
Type: Apache Web site
Apache CXF

Source: CONFIRM
Type: Vendor Advisory
N/A

Source: XF
Type: UNKNOWN
apache-cve202122696-dos(199335)

Source: MLIST
Type: Mailing List, Vendor Advisory
[announce] 20210402 [Apache CXF] CVE-2021-22696: OAuth 2 authorization service vulnerable to DDos attacks

Source: MLIST
Type: Mailing List, Vendor Advisory
[cxf-dev] 20210402 CVE-2021-22696: OAuth 2 authorization service vulnerable to DDos attacks

Source: MLIST
Type: Mailing List, Vendor Advisory
[cxf-users] 20210402 CVE-2021-22696: OAuth 2 authorization service vulnerable to DDos attacks

Source: MLIST
Type: Mailing List, Vendor Advisory
[cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html

Source: MLIST
Type: Exploit, Mailing List, Vendor Advisory
[cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html

Source: CCN
Type: oss-sec Mailing List, Thu, Fri, 2 Apr 2021 10:47:26 +0100
CVE-2021-22696: Apache CXF: OAuth 2 authorization service vulnerable to DDos attacks

Source: CCN
Type: IBM Security Bulletin 6457727 (Tivoli Application Dependency Discovery Manager)
Apache CXF vulnerability identified in IBM Tivoli Application Dependency Discovery Manager (CVE-2021-22696)

Source: CCN
Type: IBM Security Bulletin 6470833 (Global High Availability Mailbox)
Apache CXF Vulnerability Affects IBM Global Mailbox (CVE-2021-22696)

Source: CCN
Type: IBM Security Bulletin 6483061 (Tivoli Network Manager IP Edition)
Apache CXF (Publicly disclosed vulnerability)

Source: CCN
Type: IBM Security Bulletin 6520472 (QRadar SIEM)
IBM QRadar SIEM is vulnerable to using components with know vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6616297 (TRIRIGA Application Platform)
BM TRIRIGA Application Platform discloses CVE-2021-22696

Source: CCN
Type: IBM Security Bulletin 6831647 (Security Guardium)
IBM Security Guardium is affected by multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 7005971 (Security Verify Governance)
IBM Security Verify Governance uses components with known vulnerabilities (CVE-2021-22696, CVE-2021-30468, CVE-2020-1954)

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Source: CCN
Type: Oracle CPUOct2021
Oracle Critical Patch Update Advisory - October 2021

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apache:cxf:*:*:*:*:*:*:*:* (Version >= 3.4.0 and < 3.4.3)
  • OR cpe:/a:apache:cxf:*:*:*:*:*:*:*:* (Version < 3.3.10)

    • Configuration 2:
  • cpe:/a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*
  • OR cpe:/a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
  • OR cpe:/a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*
  • OR cpe:/a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* (Version >= 8.0.0 and <= 8.2.4)
  • OR cpe:/a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* (Version >= 8.0.0 and <= 8.2.4.0)
  • OR cpe:/a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*
  • OR cpe:/a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* (Version >= 8.0.0 and <= 8.1.0)
  • OR cpe:/a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* (Version >= 8.2.0 and <= 8.2.3)

    • Configuration CCN 1:
  • cpe:/a:apache:cxf:3.3.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:cxf:3.4.2:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:tririga_application_platform:2.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_network_manager:3.9:*:ip:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_network_manager:4.1.1:*:ip:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:10.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:10.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:tivoli_application_dependency_discovery_manager:7.3.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_verify_governance:10.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    apache cxf *
    apache cxf *
    oracle business intelligence 12.2.1.3.0
    oracle business intelligence 12.2.1.4.0
    oracle business intelligence 5.5.0.0.0
    oracle communications session route manager *
    oracle communications session report manager *
    oracle business intelligence 5.9.0.0.0
    oracle communications element manager 8.2.2
    oracle communications diameter intelligence hub *
    oracle communications diameter intelligence hub *
    apache cxf 3.3.9
    apache cxf 3.4.2
    ibm tririga application platform 2.7
    ibm tivoli network manager 3.9
    ibm tivoli network manager 4.1.1
    ibm qradar security information and event manager 7.3
    ibm security guardium 10.5
    ibm security guardium 10.6
    ibm tivoli application dependency discovery manager 7.3.0.0
    ibm security guardium 11.0
    ibm security guardium 11.1
    ibm qradar security information and event manager 7.4 -
    ibm security guardium 11.2
    ibm security guardium 11.3
    ibm security guardium 11.4
    ibm security verify governance 10.0