CVE-2021-22502

What it actually does

CVE-2021-22502 is an unauthenticated, network-exploitable remote code execution vulnerability in Micro Focus Operation Bridge Reporter 10.40. The flaw is categorized as command injection, meaning attacker-controlled input can be interpreted as operating-system commands by the OBR server. Successful exploitation allows arbitrary command execution with the privileges of the OBR application/service account, potentially enabling full compromise of the reporting server, access to sensitive operational data, modification of reports/configuration, and use of the host as a foothold for lateral movement.

Why it matters to the business

A vulnerable Operation Bridge Reporter server can be taken over remotely without valid credentials or user interaction. Because OBR commonly contains operational reporting data and may be connected to monitoring, database, and infrastructure management systems, compromise can expose sensitive environment information, disrupt reporting operations, and provide attackers with a path deeper into the enterprise. The vulnerability is listed in CISA Known Exploited Vulnerabilities, has active in-the-wild exploitation, and has a very high EPSS score of 0.9674, indicating urgent remediation priority; CISA’s remediation deadline was 2021-11-17.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable Micro Focus Operation Bridge Reporter 10.40 instance. They send a crafted request to the vulnerable OBR component containing command-injection payloads. The server processes the malicious input and executes attacker-supplied operating-system commands under the OBR service context. The attacker may then verify execution with benign commands, deploy a web shell or remote access tool, create persistence, enumerate local files and credentials, access OBR reports/configuration, and pivot to connected monitoring or database infrastructure. Because exploitation requires no authentication and no user interaction, scanning and opportunistic exploitation are practical at scale.

How to fix it

Upgrade Micro Focus Operation Bridge Reporter to a vendor-supported release that contains the fix for CVE-2021-22502. If a direct fixed version is not available in current asset data, obtain the applicable OBR security update or upgrade path from OpenText/Micro Focus support and do not leave OBR 10.40 exposed. Until upgraded, restrict access to OBR management and application interfaces to trusted administrative networks only, block internet exposure, enforce network-layer allowlisting, and monitor for suspicious command execution from OBR/Tomcat/Java service processes. If exploitation is suspected, treat the server as compromised: isolate it, preserve evidence, rotate credentials accessible to OBR, rebuild from trusted media if necessary, and review downstream systems that OBR connects to.

How to confirm the fix worked

Confirm all deployed Operation Bridge Reporter instances are inventoried and are no longer running vulnerable OBR 10.40 builds. Validate the installed version through the product UI, package metadata, vendor-provided version commands, or installation manifests. From a network perspective, verify OBR interfaces are not exposed to untrusted networks and are protected by firewall or access-control rules. Confirm the vendor patch or supported upgrade has been applied and that OBR services were restarted after patching. Where safe and authorized, use vulnerability scanners or vendor advisories/check scripts to validate that CVE-2021-22502 is no longer detected. Also confirm there are no unexpected child processes, unauthorized files, web shells, scheduled tasks, cron entries, or new accounts created around the exposure window.

Typical attack path

1. Identify Micro Focus Operation Bridge Reporter exposed on the network or internet.
2. Fingerprint the product/version to determine whether it is OBR 10.40 or otherwise unpatched.
3. Send a crafted command-injection request to the vulnerable OBR endpoint/component.
4. Confirm command execution using callbacks, command output, file creation, or process execution artifacts.
5. Execute reconnaissance commands to identify user context, host details, network routes, and accessible credentials.
6. Stage additional tooling such as a web shell, reverse shell, downloader, or remote access implant.
7. Access or exfiltrate operational reports, configuration files, credentials, and connected-system details.
8. Use the compromised OBR server for persistence, lateral movement, or further attacks against monitoring and infrastructure systems.

How to detect it

Review OBR application logs, web access logs, Tomcat/Java logs if applicable, operating-system authentication logs, EDR telemetry, shell command history, proxy/DNS logs, firewall flow records, and file-integrity monitoring data for signs of command execution originating from the OBR service. Look for requests containing shell metacharacters or encoded payloads, unexpected outbound connections from the OBR host, Java/Tomcat/OBR service processes spawning shells or scripting engines, new executable files in web/application temporary directories, unauthorized web shells, unusual archive or data-staging activity, and persistence artifacts such as new users, cron jobs, scheduled tasks, services, or startup scripts. Because the vulnerability is known exploited and has been public for years, include historical log review as far back as retention allows, especially before the patch date or network isolation date. If named threat intelligence is unavailable beyond known exploitation of this OBR RCE, prioritize behavior-based hunting over actor-specific indicators.

• java.*sh -c
• java.*bash -c
• java.*cmd.exe /c
• java.*powershell
• tomcat.*sh -c
• tomcat.*bash -c
• tomcat.*cmd.exe /c
• tomcat.*powershell
• wget http
• curl http
• /bin/nc -e
• nc.exe -e
• bash -i >& /dev/tcp
• /dev/tcp/
• powershell -enc
• powershell -EncodedCommand
• certutil -urlcache -split -f
• /tmp/*.sh
• /var/tmp/*.sh
• /tmp/.
• /var/tmp/.
• crontab -e
• /etc/cron.d/
• /etc/systemd/system/
• /etc/init.d/
• C:\Windows\Temp\*.ps1
• C:\Windows\Temp\*.exe
• C:\Users\Public\*.exe
• schtasks /create
• wmic process call create
• cmd.exe /c whoami
• /bin/sh -c whoami

What your security team should do

• Treat this as a critical, actively exploited vulnerability because it is unauthenticated RCE, appears in the CISA KEV catalog, and has an EPSS score of 0.9674.
• Immediately identify all Micro Focus Operation Bridge Reporter deployments and prioritize any OBR 10.40 systems for upgrade or isolation.
• Remove OBR from direct internet exposure and restrict access to trusted administrative networks or VPN-protected segments.
• Apply the vendor-supported fixed release or security update; if patching cannot be completed immediately, isolate the server and apply compensating controls.
• Hunt for evidence of exploitation before and after remediation, focusing on suspicious child processes spawned by Java/Tomcat/OBR services, outbound callbacks, file drops, and new persistence mechanisms.
• Rotate passwords, API keys, database credentials, and service credentials accessible from the OBR server if compromise cannot be confidently ruled out.
• Review firewall, proxy, EDR, application, and operating-system logs for the full exposure period because the vulnerability has been public since 2021 and is known to be exploited in the wild.
• If suspicious activity is found, perform incident response rather than simple patching: isolate, image, collect logs, eradicate persistence, and validate connected monitoring/database systems.