CoreCVE
Back

MEDIUM

wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled

Published May 10, 2022

Description

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

Affected products

Remediation

Red Hat statement

JBoss EAP 7.1 until 7.4 is not affected by default as it comes with Legacy Security enabled out-of-the-box. This only affects application scope range and the methods mentioned, no access to server data.

Red Hat mitigation

In order to avoid the possibility of information access, review application source code for '@RunAs' and 'run-as-principal' usage. Also, make sure the application is using or not Elytron Security. It's possible to investigate by checking if the commands from '$JBOSS_HOME/docs/examples/enable-elytron.cli' or similar were executed.

Weaknesses (2)

CWE-368

CWE-863

Incorrect Authorization

References (6)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner redhat
Published May 10, 2022
Updated Aug 2, 2024
Reserved Mar 4, 2022
Link CVE-2022-0866

CISA Vulnrichment

No data

NVD

Status Analyzed
Modified Jun 17, 2026
Link CVE-2022-0866

Red Hat

Severity Moderate
Public date May 3, 2022
Bugzilla 2060929
Link CVE-2022-0866

ENISA EUVD

Assigner redhat
Published May 10, 2022
Updated Aug 2, 2024
Link EUVD-2022-15908

GitHub

No data