CVE-2022-24721
📋 TL;DR
CVE-2022-24721 is an authorization bypass vulnerability in CometD web messaging framework that allows any remote user to subscribe to and publish on internal Oort and Seti channels. This exposes cluster-internal traffic containing potentially sensitive user data and enables unauthorized data manipulation. All CometD deployments using affected versions are vulnerable.
💻 Affected Systems
- CometD
📦 What is this software?
Cometd by Cometd
Cometd by Cometd
Cometd by Cometd
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive user data from cluster traffic, modify/delete user data, and disrupt cluster operations by manipulating cluster structure.
Likely Case
Unauthorized access to internal messaging channels exposing user session data and potential data tampering.
If Mitigated
Limited to authenticated users with proper channel restrictions, maintaining normal cluster operations.
🎯 Exploit Status
Exploitation requires understanding of CometD channel structure but is straightforward once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.11, 6.0.6, or 7.0.6 depending on major version
Vendor Advisory: https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv
Restart Required: Yes
Instructions:
1. Identify current CometD version. 2. Upgrade to patched version matching major version (5.x to 5.0.11+, 6.x to 6.0.6+, 7.x to 7.0.6+). 3. Restart CometD services. 4. Verify authorization policies are enforced.
🔧 Temporary Workarounds
Custom SecurityPolicy Implementation
allImplement custom SecurityPolicy that forbids subscription and publishing to remote, non-Oort sessions on Oort and Seti channels.
Implement SecurityPolicy interface with deny rules for Oort/Seti channels to unauthorized sessions
🧯 If You Can't Patch
- Implement network segmentation to restrict access to CometD cluster traffic
- Deploy Web Application Firewall (WAF) with rules to block unauthorized channel access patterns
🔍 How to Verify
Check if Vulnerable:
Check CometD version against affected ranges: if version <5.0.11, <6.0.6, or <7.0.6, system is vulnerable.Check Version:
Check application logs, configuration files, or use CometD API to query version.Verify Fix Applied:
After patching, test that unauthorized users cannot subscribe to or publish on Oort and Seti channels.📡 Detection & Monitoring
Log Indicators:
- Unauthorized subscription attempts to Oort/Seti channels
- Unexpected publishing activity on internal channels
Network Indicators:
- Unusual message traffic patterns to cluster-internal channels from unauthorized sources
SIEM Query:
source="cometd" AND (channel="Oort" OR channel="Seti") AND user="unauthenticated"