CVE-2021-22119
📋 TL;DR
Spring Security OAuth 2.0 clients are vulnerable to denial-of-service attacks where attackers can exhaust system resources by repeatedly initiating authorization requests. This affects Spring Security 5.2.x through 5.5.x with OAuth 2.0 client web applications. The vulnerability allows resource exhaustion through both single and multiple sessions.
💻 Affected Systems
- Spring Security
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, potentially affecting all users of the application.
Likely Case
Degraded performance and intermittent service disruptions under targeted attack.
If Mitigated
Minimal impact with proper rate limiting and resource monitoring in place.
🎯 Exploit Status
Attack requires no authentication and can be performed with simple HTTP requests. The technique is well-known for DoS attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.11, 5.3.10, 5.4.7, or 5.5.1
Vendor Advisory: https://spring.io/security/cve-2021-22119
Restart Required: Yes
Instructions:
1. Identify your Spring Security version. 2. Upgrade to the patched version for your release line. 3. Update dependencies in your build configuration. 4. Rebuild and redeploy your application. 5. Restart the application server.
🔧 Temporary Workarounds
Rate Limiting Implementation
allImplement rate limiting on OAuth 2.0 authorization request endpoints to prevent resource exhaustion.
Session Limitation
allConfigure session management to limit concurrent sessions per user and implement session timeouts.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to detect and block excessive authorization requests
- Deploy resource monitoring and alerting for abnormal request patterns to OAuth endpoints
🔍 How to Verify
Check if Vulnerable:
Check your Spring Security version in pom.xml, build.gradle, or application dependencies. Verify if using OAuth 2.0 client with Authorization Code Grant.Check Version:
For Maven: mvn dependency:tree | grep spring-security. For Gradle: gradle dependencies | grep spring-security.Verify Fix Applied:
Confirm Spring Security version is 5.2.11+, 5.3.10+, 5.4.7+, or 5.5.1+. Test authorization request endpoints under load.📡 Detection & Monitoring
Log Indicators:
- High frequency of authorization request initiations
- Abnormal session creation patterns
- Resource exhaustion warnings in application logs
Network Indicators:
- Multiple rapid requests to /oauth2/authorization/* endpoints
- Unusual traffic patterns from single IPs to OAuth endpoints
SIEM Query:
source="application.logs" AND ("authorization request" OR "/oauth2/authorization/") | stats count by src_ip, user_agent | where count > threshold🔗 References
- https://lists.apache.org/thread.html/r08a449010786e0bcffa4b5781b04fcb55d6eafa62cb79b8347680aad%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc%40%3Cpluto-scm.portals.apache.org%3E
- https://tanzu.vmware.com/security/cve-2021-22119
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.apache.org/thread.html/r08a449010786e0bcffa4b5781b04fcb55d6eafa62cb79b8347680aad%40%3Cissues.nifi.apache.org%3E
- https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f%40%3Cpluto-dev.portals.apache.org%3E
- https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc%40%3Cpluto-scm.portals.apache.org%3E
- https://tanzu.vmware.com/security/cve-2021-22119
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
