CVE-2022-0866
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
10/05/2022
Last modified:
06/11/2025
Description
This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Base Score 2.0
4.30
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:* | 7.1.0 (including) | |
| cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:* | 11.0.0 (including) | 26.1.1 (excluding) |
| cpe:2.3:a:redhat:wildfly:27.0.0:alpha1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page