---
id: 8588
title: "[CVE-2022-34169] Gregor Samsa: Exploiting Java's XML Signature Verification"
cve: CVE-2022-34169
source_domain: projectzero.google
source_url: "https://projectzero.google/2022/11/gregor-samsa-exploiting-java-xml.html"
published_at: "2022-11-02T00:00:00Z"
tags: ["exploit", "vulnerability", "security-research"]
phying_url: "https://phying.com/item/8588"
lang: en
---

# [CVE-2022-34169] Gregor Samsa: Exploiting Java's XML Signature Verification

## Summary

Earlier this year, I discovered a surprising attack surface hidden deep inside Java’s standard library: A custom JIT compiler processing untrusted XSLT programs, exposed to remote attackers during XML signature verification. This post discusses CVE-2022-34169, an integer truncation bug in this JIT compiler resulting in arbitrary code execution in many Java-based web applications and identity providers that support the SAML single-sign-on standard.

## Intelligence Metadata

- **Sources:** projectzero.google
- **CVE:** CVE-2022-34169
- **Published:** 2022-11-02T00:00:00Z
- **Original:** https://projectzero.google/2022/11/gregor-samsa-exploiting-java-xml.html
- **Phying News:** https://phying.com/item/8588