CVE DatabaseCVE-2022-21445

Updated 2026-06-17한국어 권고문 →

CVE-2022-214459.8/CRITICALCISA KEVCWE-502CWE-502

Oracle ADF Faces Remote Code Execution (RCE) and System Takeover Vulnerability (CVE-2022-21445) Analysis & Mitigation Guide

⚡ Jump to Patch

Affected Vendors

oracle

Affected Components

application development framework, adf faces, jdeveloper

Published Date

2022-04-19

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

62.5%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle Fusion Middleware - Oracle Application Development Framework (ADF) versions 12.2.1.3.0 and 12.2.1.4.0

Impact

Unauthenticated remote attackers can execute arbitrary code and completely compromise the host system via HTTP network access

Mitigation

Apply the official Oracle Critical Patch Update (CPU) immediately or restrict external access to vulnerable ADF endpoints

Affected Products & Version Scope

Oracle Application Development Framework (ADF) versions 12.2.1.3.0 and 12.2.1.4.0 (typically distributed via Oracle JDeveloper)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official Oracle Critical Patch Update (CPU) using the OPatch utility. Ensure your Oracle environment variables are correctly configured before applying the patch.

bash

# Verify Oracle Home environment variable
echo $ORACLE_HOME

# Check OPatch utility version and readiness
cd $ORACLE_HOME/OPatch
./opatch version

# Extract and apply the downloaded Oracle CPU patch
unzip p34000000_122140_Generic.zip -d /tmp/patch
cd /tmp/patch/34000000
$ORACLE_HOME/OPatch/opatch apply

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, configure a Web Application Firewall (WAF) or reverse proxy to block incoming requests containing Java serialized object signatures (e.g., Base64 'rO0AB').

nginx

# Nginx Reverse Proxy mitigation rule
server {
    listen 80;
    server_name adf-app.local;

    location / {
        # Block requests containing Java serialization magic bytes (rO0AB)
        if ($request_body ~* 'rO0AB' ) {
            return 403 'Blocked: Malicious payload signature detected';
        }
        
        proxy_pass http://adf_backend_servers;
    }
}

3. Log Audit & IoC Verification Commands

Inspect application and web server logs to identify potential exploitation attempts or deserialization errors.

bash

# Search WebLogic/ADF logs for Java deserialization exceptions
grep -ri 'java.io.ObjectInputStream' /u01/oracle/user_projects/domains/*/servers/*/logs/

# Scan HTTP access logs for Base64 encoded Java serialization headers
grep -ri 'rO0AB' /var/log/nginx/access.log /var/log/httpd/access_log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

As this vulnerability is actively exploited in the wild (CISA KEV), immediately apply the Oracle CPU patch and restrict public access to ADF Faces endpoints.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability is a critical deserialization flaw (CWE-502) residing in the ADF Faces component of Oracle Application Development Framework (ADF) within Oracle Fusion Middleware. The root cause lies in the unsafe deserialization of untrusted user-supplied data without proper validation, allowing attackers to instantiate arbitrary Java objects on the application server.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP POST request containing a malicious serialized Java object to the vulnerable ADF Faces endpoint. Since the application deserializes the payload automatically without requiring any authentication (PR:N) or user interaction (UI:N), the embedded payload executes in the context of the application server process, leading to immediate remote code execution.

3. Infrastructure & Business Impact

With a CVSS 3.1 Base Score of 9.8 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an extreme risk to enterprise environments. Successful exploitation allows complete takeover of the Oracle ADF application, enabling attackers to exfiltrate sensitive databases, deploy ransomware, and pivot laterally into the internal corporate network.

Official Vendor Advisories & References

NVD Original English Description

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: secalert_us@oracle.com · Vendor Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21445

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2022-21445)

FAQ

Q1. How critical is CVE-2022-21445 and is it actively exploited in the wild?

CVE-2022-21445 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 62.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2022-21445?

Primary impacted vendors include oracle across application development framework, adf faces, jdeveloper. Scope summary: Oracle Application Development Framework (ADF) versions 12.2.1.3.0 and 12.2.1.4.0 (typically distributed via Oracle JDeveloper)

Q3. What temporary mitigations or workarounds exist for CVE-2022-21445 before patching?

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately or restrict external access to vulnerable ADF endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION