CVE-2022-21445
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
Description
CVE-2022-21445 is a critical remote code execution vulnerability in Oracle Application Development Framework (ADF) Faces, a component of Oracle Fusion Middleware. Affecting versions 12.2.1.3.0 and 12.2.1.4.0, this flaw allows unauthenticated attackers with network access via HTTP to fully compromise the ADF application. Rated CVSS 9.8 (Critical) with an EPSS probability of 92.03% (99.7th percentile), the vulnerability is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of October 9, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | application development framework | 12.2.1.3.0; 12.2.1.4.0 |
References
- https://www.oracle.com/security-alerts/cpuapr2022.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21445(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2022-21445 by NVD. The vulnerability is rooted in a deserialization flaw within the ADF Faces component of Oracle Fusion Middleware. Oracle ADF Faces processes serialized Java objects as part of its view state handling mechanism, and insufficient validation of these objects allows an attacker to inject crafted payloads that execute arbitrary code upon deserialization. This class of vulnerability typically maps to unsafe deserialization patterns, where the application trusts and processes serialized data from untrusted sources without proper type checking or sandboxing. The HTTP-based attack vector makes this particularly dangerous as it bypasses typical network-layer defenses.
Impact Analysis
The exploitation of CVE-2022-21445 has devastating consequences for affected organizations. Confidentiality is fully compromised, enabling attackers to extract sensitive business data, user credentials, database connection strings, and any information accessible to the ADF application's runtime context. Integrity is equally affected, as successful exploitation grants the ability to modify application behavior, inject malicious code, alter backend database records, and manipulate business processes managed through ADF-based applications. Availability faces total disruption, allowing attackers to crash the application server, deploy denial-of-service payloads, or render enterprise applications unusable.
The vulnerability requires no authentication and no user interaction, making it trivially exploitable from the network. The EPSS score of 92.03% places it in the 99.7th percentile, indicating near-certain exploitation activity within any given 30-day window. While the CISA KEV entry lists ransomware association as "Unknown," the complete system compromise capability makes this vulnerability an ideal pivot point for attackers. Oracle ADF is widely deployed in enterprise environments for building business-critical web applications, meaning a successful exploit can grant access to core business systems, financial data, and customer records. Organizations face potential regulatory penalties, reputational damage, and significant financial losses from data breaches facilitated through this vulnerability.
Exploit Maturity
CVE-2022-21445 is confirmed to be actively exploited in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 9, 2024. The EPSS score of 92.03% (99.7th percentile) reflects an extremely high probability of continued exploitation. While the KEV catalog lists the ransomware association as "Unknown," the unauthenticated remote code execution capability via HTTP makes this vulnerability highly attractive to a wide range of threat actors, from advanced persistent threat (APT) groups to financially motivated cybercriminals. The fact that exploitation requires only standard HTTP access means that any internet-facing ADF application is directly exposed, and internal applications are vulnerable to lateral movement scenarios. Public documentation of ADF deserialization attack techniques further lowers the barrier to exploitation.
Remediation
-
Apply Oracle's April 2022 Critical Patch Update (CPU) immediately by following the guidance in Oracle's security advisory. This patch addresses the deserialization vulnerability in the ADF Faces component and is the definitive fix for the issue.
-
Restrict network access to ADF applications by placing Web Application Firewalls (WAFs) in front of all ADF-based deployments. Configure the WAF to inspect and filter HTTP requests for serialized Java object payloads that match known deserialization exploit patterns.
-
Upgrade Oracle Fusion Middleware to the latest supported version beyond 12.2.1.3.0 and 12.2.1.4.0, ensuring all cumulative security patches are applied. Review Oracle's quarterly CPU schedule and maintain a consistent patching cadence.
-
Audit and harden the ADF deployment configuration by disabling unnecessary ADF Faces features, limiting the serialization classes allowed through Java deserialization filters (JEP 290), and reducing the application's attack surface by removing unused components and endpoints.
-
Perform a thorough compromise assessment on all systems running affected ADF versions prior to patching. Investigate for web shells, unauthorized file modifications, anomalous outbound connections, and new user accounts that may indicate a prior breach.
Technical Details
CVE-2022-21445 has a CVSS v3.1 base score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector breakdown reveals the maximum exploitability characteristics: Attack Vector (AV:N) means the vulnerability is exploitable from any network location. Attack Complexity (AC:L) indicates exploitation is straightforward with no special prerequisites. Privileges Required (PR:N) confirms no authentication is needed. User Interaction (UI:N) means the attack is fully automated. Scope (S:U) indicates the impact stays within the vulnerable component's authority. All three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated High, signifying complete compromise.
The attack targets Oracle ADF Faces' handling of view state data transmitted over HTTP. ADF Faces serializes UI component state and transmits it between client and server during page interactions. When the server receives a crafted HTTP request containing a malicious serialized Java object embedded in the view state parameter, the ADF framework deserializes the object without adequate validation. The attacker constructs a deserialization gadget chain using classes available on the WebLogic Server classpath to achieve arbitrary code execution. Since ADF Faces processes these requests before any application-level authentication, the attack succeeds without valid credentials.
Frequently Asked Questions
What is CVE-2022-21445?
CVE-2022-21445 is a critical deserialization vulnerability in Oracle Application Development Framework (ADF) Faces, part of Oracle Fusion Middleware. It allows unauthenticated attackers to execute arbitrary code on the server via crafted HTTP requests, achieving complete system compromise.
Which Oracle products are affected by this vulnerability?
The vulnerability affects Oracle ADF Faces versions 12.2.1.3.0 and 12.2.1.4.0. Since ADF is a component of Oracle Fusion Middleware, any application built with these ADF versions and deployed on WebLogic Server is potentially vulnerable, including Oracle E-Business Suite, PeopleSoft, and custom ADF applications.
How can I protect my ADF applications while planning the patch deployment?
As an immediate mitigation, deploy a Web Application Firewall (WAF) to inspect HTTP traffic for deserialization exploit payloads. Restrict network access to ADF applications to only authorized users and IP ranges. Enable Java deserialization filters (JEP 290) to limit which classes can be deserialized.
Is there evidence of active exploitation?
Yes, CISA has confirmed active exploitation by adding CVE-2022-21445 to its Known Exploited Vulnerabilities catalog. The EPSS score of 92.03% further confirms widespread exploitation activity, making immediate patching essential for all affected organizations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.