CVE-2022-21445
📋 TL;DR
CVE-2022-21445 is a critical deserialization vulnerability in Oracle ADF Faces that allows unauthenticated remote attackers to execute arbitrary code. Affected systems include Oracle Fusion Middleware ADF versions 12.2.1.3.0 and 12.2.1.4.0. Successful exploitation results in complete compromise of the ADF application server.
💻 Affected Systems
- Oracle Application Development Framework (ADF) Faces
📦 What is this software?
Application Development Framework by Oracle
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with full administrative control, data exfiltration, and potential lateral movement to other systems.
Likely Case
Remote code execution leading to data theft, application compromise, and potential ransomware deployment.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
CISA has added this to their Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patches from Oracle Critical Patch Update April 2022
Vendor Advisory: https://www.oracle.com/security-alerts/cpuapr2022.html
Restart Required: Yes
Instructions:
1. Download appropriate patches from Oracle Support. 2. Apply patches to affected ADF installations. 3. Restart application servers. 4. Verify patch application.
🔧 Temporary Workarounds
Network Access Control
allRestrict HTTP access to ADF applications to trusted networks only
Web Application Firewall Rules
allImplement WAF rules to block suspicious deserialization patterns
🧯 If You Can't Patch
- Isolate affected systems from internet and untrusted networks
- Implement strict network segmentation and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Oracle ADF version in application server configuration or via Oracle Enterprise ManagerCheck Version:
opatch lsinventory | grep -i adfVerify Fix Applied:
Verify patch application through Oracle OPatch utility and confirm version is no longer 12.2.1.3.0 or 12.2.1.4.0📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to ADF endpoints
- Java deserialization errors in application logs
- Unexpected process execution
Network Indicators:
- HTTP requests with serialized Java objects to ADF paths
- Unusual outbound connections from application servers
SIEM Query:
source="*adf*" AND (http_method="POST" OR http_method="PUT") AND (uri="*/adf*" OR user_agent="*Java*" OR content_type="*serialized*" OR content_type="*java*" OR content_type="*application/x-java*" OR content_type="*application/x-java-serialized-object*")