CVE-2021-22696

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.4.3 Apache CXF versions prior to 3.3.10

Description The issue concerns the handling of OAuth 2 parameters via a JWT token. Specifically, the "request uri" parameter allows specifying a URI from which to retrieve a JWT token. However, the software was not properly validating this parameter, making a REST request to the specified URI to retrieve a token. This lack of validation made the software vulnerable to DDos attacks on the authorization server, as outlined in section 10.4.1 of the spec.

Recommendations For versions prior to 3.4.3, update to version 3.4.3 or later to resolve the issue. For versions prior to 3.3.10, update to version 3.3.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the request uri parameter to minimize the risk of exploitation.