CVE-2022-21291

What it actually does

The flaw in the Hotspot component permits an unauthenticated network attacker to perform unauthorized update, insert, or delete operations on accessible data through multiple protocols or APIs, particularly when untrusted code executes in sandboxed environments.

Why it matters to the business

Systems relying on the affected Java deployments face risk of data tampering that can disrupt application integrity and require immediate remediation; widespread downstream use of the library amplifies exposure across many organizations.

How an attack unfolds

An attacker with network access crafts requests or supplies malicious data via APIs or web services to the Hotspot component, exploiting the authorization bypass to modify data without authentication, especially in deployments handling untrusted code from the internet.

How to fix it

Apply the fixed versions listed for gitlab-org/gitlab (GIT) including commits 661f7e4160fd380b54f36039b0e7f585b4cdb647, d69f38d4a95eb664a8987247b61d8d1130c9f94a and subsequent patches; upgrade Oracle Java SE and GraalVM Enterprise Edition beyond the listed affected releases.

How to confirm the fix worked

Confirm deployment versions exceed the affected Oracle Java SE and GraalVM releases, review patch notes for the supplied GitLab commits, and perform functional testing of data integrity controls in sandboxed execution paths.

Typical attack path

1. Locate exposed Java deployments or services using the affected Hotspot component
2. Send crafted network traffic or API calls supplying untrusted data
3. Trigger the flaw to gain unauthorized write access and alter stored data

How to detect it

Review application and Java runtime logs for unexpected data modification events originating from network or API sources; inspect sandboxed execution traces for unauthorized write operations.

What your security team should do

• Immediately upgrade all instances to the provided fixed commits or newer releases
• Audit Java-based services for exposure to untrusted code or network-accessible APIs
• Monitor data modification logs for anomalies until patching is complete