CVE-2022-21445: Oracle ADF Faces Deserialization of Untrusted Data Vulnerability

CVE-2022-21445 is a deserialization of untrusted data vulnerability in the Oracle ADF Faces library, which is included with the Oracle JDeveloper Distribution. Per available details, it can lead to unauthenticated remote code execution.

This matters for IT and security teams because an unauthenticated attacker who can reach the vulnerable component may execute code on the host, potentially compromising applications built with Oracle ADF Faces and any data or systems they touch. Specifics such as exact affected builds must be confirmed against the vendor advisory.

How it works

The underlying weakness is CWE-502: Deserialization of Untrusted Data. In this class of flaw, an application accepts serialized objects from an untrusted source and reconstructs them without sufficient validation. When the deserialization process handles attacker-controlled data, it can trigger the instantiation of unexpected classes or the execution of attacker-chosen methods.

For Oracle ADF Faces, the CISA summary states that the library contains this vulnerability leading to unauthenticated remote code execution. An attacker would typically send a crafted payload to a reachable endpoint that performs deserialization. No further exploit mechanics, payload formats, or preconditions are provided in the available facts; defenders should treat any network-accessible ADF Faces component as potentially exposed until the vendor advisory is reviewed for precise attack surface details.

Am I affected? How to find it in your systems

Oracle ADF Faces is a component library commonly used in applications developed with Oracle JDeveloper and deployed in Java EE or related Oracle middleware environments. It may appear in custom enterprise applications, portals, or internal tools that rely on Oracle Application Development Framework (ADF) Faces for the presentation layer.

• Inventory systems by searching for Oracle JDeveloper installations, ADF Faces libraries (for example, jar files or modules containing ADF Faces packages), and applications that declare dependencies on Oracle ADF components.
• Review software bills of materials, build manifests, and runtime classpaths for references to ADF Faces.
• Check configuration and deployment descriptors for ADF-related servlets, filters, or view handlers that might accept serialized input.
• Confirm exact product versions and patch levels against the vendor advisory, as public detail on version ranges is limited here.

Telemetry signs of exploitation for this class include unexpected process creation, unusual Java deserialization activity, anomalous network traffic to application endpoints that handle object streams, or sudden privilege escalations. Correlate application logs, web server access logs, and endpoint detection alerts for indicators of remote code execution attempts. Because known ransomware use is not documented for this CVE, prioritize general RCE indicators rather than ransomware-specific signatures.

How to remediate

The primary remediation is to apply the vendor-supplied update or mitigations for Oracle ADF Faces as described in the official advisory. CISA guidance is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• Obtain and deploy the fixed library or cumulative patch from Oracle that addresses CVE-2022-21445.
• After patching, re-inventory to verify the vulnerable ADF Faces components have been replaced.
• For the broader deserialization class, harden by restricting which classes can be deserialized (allow-lists), validating all untrusted input before deserialization, and removing unnecessary deserialization endpoints where feasible.
• Retest the application to confirm the vulnerable code path is no longer reachable.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls tailored to unauthenticated remote code execution via deserialization.

• Network segmentation: isolate systems running Oracle ADF Faces so that only trusted management and application tiers can reach them; block direct internet or untrusted network access to the relevant ports and endpoints.
• Virtual patching or WAF rules: deploy rules that detect and block common Java deserialization gadget patterns or anomalous serialized object streams, while confirming the rules do not break legitimate traffic.
• Disable or restrict the affected feature: if the application configuration allows, turn off or tightly control any ADF Faces functionality that performs deserialization of external data.
• Enhanced monitoring: increase logging and alerting on the application servers for process spawning, unusual class loading, and outbound connections; feed these into your SIEM for rapid response.
• If mitigations remain unavailable, plan to discontinue use of the vulnerable product as directed by CISA.

If your data may have been exposed

Actively exploited remote code execution vulnerabilities can lead to full system compromise and subsequent data breaches. Review logs for signs of successful exploitation, isolate affected hosts, and follow your incident response process. Known ransomware use is not documented for this CVE. As a further check, you can run a free exposure scan of your email addresses against known breach data to determine whether credentials or personal information have already appeared in public breach corpora.