CVE-2022-46337: Apache Derby LDAP injection in authenticator

CVE-2022-46337 · Severity: critical · CVSS 9.8 · Published 2023-11-20

Apache Derby, a popular database engine, is vulnerable to an authentication bypass when configured to use LDAP for user verification. An attacker can use a specially crafted username to gain unauthorized access to the database. This could allow them to steal or corrupt sensitive data, crash the system by filling up disk space, or execute malicious code on the server.

Technologies: org.apache.derby:derby (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2022-46337 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-46337 being exploited in the wild.
How severe is CVE-2022-46337?
Critical severity, with a CVSS score of 9.8, published 20 November 2023.
Which products and versions are affected?
Apache Software Foundation Derby >= 10.1.1.0, <= 10.16.1.1; org.apache.derby:derby (Maven) ECOSYSTEM:introduced=10.1.1.0,last_affected=10.1.3.1.
Is there a fix for CVE-2022-46337?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-46337 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-46337?
Check whether you run Apache Software Foundation Derby or org.apache.derby:derby (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An LDAP injection vulnerability exists in the Apache Derby authenticator component (CWE-74, CWE-94). The vulnerability arises from improper neutralization of special elements in usernames when Derby is configured to use LDAP authentication. A remote, unauthenticated attacker can provide a specially crafted username to bypass authentication checks. Successful exploitation allows the attacker to create junk databases to cause denial-of-service via disk exhaustion, execute arbitrary code with the privileges of the Derby server process, or perform unauthorized SQL operations if granular GRANT/REVOKE permissions are not implemented. The issue is addressed in Derby 10.17.1.0 (for Java 21) and backported to versions 10.16.1.2, 10.15.2.1, and 10.14.2.1.

Affected products

  • Apache Derby >= 10.1.1.0, <= 10.16.1.1

Identifiers

  • CVE-2022-46337
  • GHSA-rcjc-c4pj-xxrp

Timeline

  • 2023-11-20: advisory
  • 2023-11-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.