CVE-2022-24721 Incorrect Authorization in org.cometd.oort

What is CVE-2022-24721?

CVE-2022-24721 is a high-severity missing authorization vulnerability in cometd, published on 15 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other users' (possibly sensitive) data. By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure. A fix is available in versions 5.0.11, 6.0.6, and 7.0.6. As a workaround, install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.

Weakness: CWE-863

Which versions are affected by CVE-2022-24721?

6 open source packages ship an affected version, including org.cometd.java:cometd-java-oort. It affects 1 product.

Products include Cometd Cometd.

How do I fix CVE-2022-24721?

Upgrade org.cometd.java:cometd-java-oort to a fixed version for your release line: 5.0.11, 6.0.6 or 7.0.6.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-24721 being exploited?

There is no known exploitation of CVE-2022-24721 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rjmq-6v55-4rjv.