CVE-2022-21445

What it actually does

CVE-2022-21445 is a remotely exploitable Oracle JDeveloper / Oracle ADF Faces vulnerability affecting supported 12.2.1.3.0 and 12.2.1.4.0 deployments. The flaw allows an unauthenticated attacker with HTTP network access to send crafted requests to the ADF Faces component and compromise the application. Public advisories describe the impact as complete takeover with high confidentiality, integrity, and availability impact; the vulnerability has been associated with unsafe deserialization behavior in ADF Faces, meaning attacker-controlled data may be processed in a way that can lead to arbitrary code execution or equivalent application compromise.

Why it matters to the business

Successful exploitation can give an external attacker control of an affected Oracle JDeveloper or ADF Faces application without needing credentials. This can result in data theft, application tampering, deployment of malware or web shells, service disruption, and use of the compromised middleware server as a foothold into adjacent systems. The vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2024-10-09, so unpatched internet-facing systems should be treated as high-priority exposure even though the issue was published in 2022.

How an attack unfolds

An attacker first identifies an Oracle JDeveloper or Oracle ADF Faces application exposed over HTTP or HTTPS, typically by fingerprinting ADF-specific paths, response headers, JavaScript resources, or page content. The attacker then sends a crafted unauthenticated HTTP request to the vulnerable ADF Faces component. If the target is running an affected unpatched version, the component processes attacker-controlled input in an unsafe way, which can result in execution of attacker-controlled logic or complete application takeover. After initial code execution or control of the application context, the attacker may deploy a web shell, run commands through the Java application server process, modify application content, access configuration files and credentials, pivot to databases or internal services reachable from the middleware host, and establish persistence.

How to fix it

Apply the relevant Oracle Critical Patch Update that remediates CVE-2022-21445 for Oracle JDeveloper / Oracle Fusion Middleware ADF Faces. Affected supported versions are 12.2.1.3.0 and 12.2.1.4.0; upgrade to an Oracle-supported patched release or apply Oracle’s CPU patches for the installed release. Because no safe configuration workaround should be considered equivalent to patching, prioritize patching all internet-facing and partner-facing deployments first. If immediate patching is not possible, restrict HTTP/HTTPS access to trusted networks, place the application behind a WAF or reverse proxy with strict allow rules, block access to unused ADF Faces endpoints, disable nonessential affected applications, and monitor aggressively for exploitation attempts. After patching, rotate credentials and secrets stored on or accessible from the affected middleware tier if exploitation cannot be confidently ruled out.

How to confirm the fix worked

Confirm the installed Oracle JDeveloper / Fusion Middleware / ADF Faces version and patch inventory using Oracle OPatch or the platform’s supported inventory tooling, and verify that the applicable Oracle Critical Patch Update is installed for all affected homes and domains. Validate that no exposed service remains on vulnerable 12.2.1.3.0 or 12.2.1.4.0 code without the security patch. From an external perspective, confirm that ADF Faces applications are not directly reachable except where required and that access controls or WAF rules are active. Review application behavior after patching to ensure ADF pages still function correctly. For higher assurance, perform authenticated configuration review and targeted vulnerability scanning with a scanner that explicitly checks for CVE-2022-21445 rather than relying only on banner detection.

Typical attack path

1. Scan the internet or target network for Oracle JDeveloper, Oracle Fusion Middleware, or ADF Faces applications exposed over HTTP/HTTPS.
2. Fingerprint likely vulnerable ADF Faces endpoints, static resources, or application responses associated with versions 12.2.1.3.0 or 12.2.1.4.0.
3. Send a crafted unauthenticated HTTP request to the vulnerable ADF Faces component.
4. Trigger unsafe server-side processing of attacker-controlled data, resulting in application compromise or code execution under the application server account.
5. Deploy a web shell or secondary payload into the application server, temporary deployment directories, or writable web-accessible paths.
6. Use the compromised Java middleware process to read configuration files, credentials, data sources, application secrets, and application data.
7. Move laterally to connected databases, identity services, file shares, or internal applications reachable from the compromised host.
8. Maintain persistence and cover tracks by modifying application artifacts, rotating payload names, clearing logs, or blending activity into normal Java application server traffic.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, reverse proxy logs, WAF logs, WebLogic server logs, Oracle Diagnostic Logging output, ADF Faces application logs, operating system process telemetry, EDR events, and filesystem change records. Focus on unauthenticated POST requests to ADF Faces or JavaServer Faces paths, requests containing serialized Java payload indicators, unusual binary or base64-like request bodies, high rates of HTTP 500 errors followed by successful requests, and requests from unfamiliar internet hosts. In application logs, look for Java deserialization errors, ADF Faces stack traces, class loading anomalies, unexpected deployment activity, or exceptions involving Oracle ADF internal packages. On hosts, investigate Java, WebLogic, or JDeveloper processes spawning operating system shells or network utilities. Inspect Oracle Middleware homes, domain directories, application deployment directories, temporary directories, and web-accessible paths for recently modified JSP files, WAR files, JAR files, class files, or scripts. Because exploitation may result in full application takeover, also review outbound network connections from the middleware host, newly scheduled tasks or cron jobs, new local users, modified startup scripts, and credential access to data source configuration files.

• CVE-2022-21445
• rO0AB
• aced0005
• java.io.StreamCorruptedException
• java.io.InvalidClassException
• java.io.ObjectInputStream
• java.io.ObjectStreamClass
• Invalid stream header
• oracle.adfinternal.view.faces
• oracle.adf.view.rich
• org.apache.myfaces.trinidad
• javax.faces.ViewState
• /adf/
• /adf/faces/
• /afr/
• /afr/blank.html
• /afr/loopback
• /javax.faces.resource/
• /WEB-INF/web.xml
• /WEB-INF/classes/
• /WEB-INF/lib/
• /_WL_user/
• /servers/AdminServer/tmp/
• /servers/*/tmp/_WL_user/
• /Oracle/Middleware/
• /user_projects/domains/
• cmd.exe /c
• /bin/sh -c
• /bin/bash -c
• powershell.exe
• certutil.exe
• curl
• wget
• nc -e
• jsp file created
• war file deployed

What your security team should do

• Immediately inventory Oracle JDeveloper, Oracle Fusion Middleware, and ADF Faces applications, especially internet-facing HTTP/HTTPS services.
• Patch or upgrade affected 12.2.1.3.0 and 12.2.1.4.0 deployments using Oracle’s applicable Critical Patch Update; prioritize exposed systems first.
• Treat unpatched exposed systems as potentially compromised because the vulnerability is in CISA KEV and has active exploitation in the wild.
• If patching is delayed, restrict access at firewalls, load balancers, VPNs, reverse proxies, and WAFs to only trusted source networks.
• Hunt for exploitation in web access logs, WebLogic or Java application logs, ADF diagnostic logs, deployment directories, temporary directories, and operating system process telemetry.
• Look for suspicious child processes spawned by Java, WebLogic, or JDeveloper-related processes, including shell, PowerShell, curl, wget, certutil, bash, sh, cmd.exe, and python.
• Search for newly created JSP, WAR, class, JAR, or script files in Oracle Middleware homes, domain directories, application deployment directories, and temporary deployment paths.
• Rotate application secrets, database credentials, API keys, and service account credentials accessible to the middleware tier if compromise is suspected or log coverage is incomplete.
• Add SIEM detections for ADF Faces exploit patterns, Java deserialization indicators, anomalous POST requests, and web shell behavior.
• Preserve relevant logs and filesystem evidence before reimaging or cleanup if exploitation is suspected.