CVE-2020-15824: JetBrains Kotlin Privilege Escalation

CVE-2020-15824 Overview

CVE-2020-15824 is a privilege escalation vulnerability in JetBrains Kotlin versions 1.4-M1 through 1.4-RC. The flaw resides in kotlin-main-kts, which caches compiled scripts in the system temporary directory shared by all local users. An attacker with local access can plant or replace cached script artifacts, causing another user to execute attacker-controlled code under their own identity. Kotlin 1.3.7x is not affected, and the issue is fixed in Kotlin 1.4.0. The vulnerability is mapped to [CWE-269: Improper Privilege Management]. Downstream Oracle products including Banking Extensibility Workbench and Communications Cloud Native Core Policy also shipped affected Kotlin components.

Critical Impact
A local attacker can escalate privileges by poisoning shared cached Kotlin scripts, leading to code execution in the context of other users invoking kotlin-main-kts.

Affected Products

JetBrains Kotlin 1.4-M1, 1.4-M2, 1.4-M3, and 1.4-RC
Oracle Banking Extensibility Workbench 14.2, 14.3, and 14.5
Oracle Communications Cloud Native Core Policy 1.14.0

Discovery Timeline

2020-08-06 - JetBrains publishes Q2 2020 security bulletin documenting the issue
2020-08-08 - CVE-2020-15824 published to NVD
2021-10 - Oracle addresses the issue in the October 2021 Critical Patch Update
2022-01 - Oracle addresses the issue in the January 2022 Critical Patch Update
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-15824

Vulnerability Analysis

The kotlin-main-kts artifact provides a self-contained way to run .main.kts scripts with dependency resolution and compiled-script caching. To avoid recompiling on every invocation, the runtime stores compiled script artifacts on disk and reloads them when input scripts match a cache key. In affected 1.4 milestone and RC builds, those cached artifacts are written into the operating system's shared temporary directory using default permissions.

Because the system temp directory is writable by every local user, one user can stage malicious cached output that another user's kotlin-main-kts process will trust and load. The deserialized or loaded class executes in the victim's process with the victim's privileges. This breaks the user-isolation boundary expected on multi-user hosts and CI runners.

Root Cause

The root cause is improper privilege management combined with insecure use of a shared filesystem location. The cache mechanism does not isolate output per user, does not validate the integrity or authenticity of cached compiled scripts, and does not restrict permissions on the cache directory. Any local principal with write access to the temp directory can substitute cached artifacts that downstream invocations will load without verification.

Attack Vector

Exploitation requires local access and the ability to write to the shared temporary directory. An attacker enumerates expected cache file names produced by kotlin-main-kts, then writes a malicious compiled-script artifact at the predicted path. When a higher-privileged user, build agent, or service account runs a Kotlin script that resolves to the same cache key, the runtime loads the attacker's artifact and executes it in the victim's context. Shared developer workstations, multi-tenant build servers, and container hosts that mount a common /tmp are the most exposed environments.

No verified public exploit code is available. See the JetBrains Security Bulletin Q2 2020 and the Openwall OSS Security Post for vendor technical detail.

Detection Methods for CVE-2020-15824

Indicators of Compromise

Unexpected files matching kotlin-main-kts cache naming patterns in /tmp or %TEMP% owned by users other than the script invoker.
Modification timestamps on cached .jar or compiled-script artifacts in the system temp directory that predate or do not correlate with legitimate script execution.
Kotlin script processes spawning child processes or making network connections that do not match the source .main.kts content.

Detection Strategies

Inventory installed Kotlin versions across developer endpoints, CI runners, and Oracle product deployments and flag any in the 1.4-M1 through 1.4-RC range.
Audit ownership and permissions of files in shared temporary directories on multi-user systems, alerting when one user writes cache files later read by another user.
Correlate kotlin-main-kts process executions with the originating script path and hash, then compare against the loaded cached artifact to identify mismatches.

Monitoring Recommendations

Enable filesystem auditing on /tmp, /var/tmp, and Windows %TEMP% for write events tied to kotlin cache filenames.
Forward process-execution telemetry from build servers and developer workstations to a central data lake for retrospective hunting on Kotlin script invocations.
Alert on cross-user file access patterns where one principal writes and a different principal reads from the temp directory within a short window.

How to Mitigate CVE-2020-15824

Immediate Actions Required

Upgrade JetBrains Kotlin to 1.4.0 or later on all developer machines, build agents, and embedded runtimes.
Apply the relevant Oracle Critical Patch Updates from October 2021 and January 2022 for Banking Extensibility Workbench and Communications Cloud Native Core Policy.
Purge existing kotlin-main-kts cache files from shared temp directories on multi-user hosts before resuming script execution.

Patch Information

JetBrains fixed the issue in Kotlin 1.4.0, as documented in the JetBrains Security Bulletin Q2 2020. Oracle remediated affected products through the Oracle CPU October 2021 Alert and the Oracle CPU January 2022 Alert. Kotlin 1.3.7x is not vulnerable and does not require action for this CVE.

Workarounds

Restrict kotlin-main-kts usage to single-user systems until upgrades complete, avoiding shared CI hosts.
Configure the Java java.io.tmpdir system property to point to a per-user, mode 0700 directory before invoking Kotlin scripts.
Disable script caching where supported, or wrap script execution to clear the cache directory before each run on multi-tenant systems.

bash

# Configuration example: redirect Kotlin script cache to a per-user private directory
mkdir -p "$HOME/.kotlin-cache"
chmod 700 "$HOME/.kotlin-cache"
export JAVA_OPTS="-Djava.io.tmpdir=$HOME/.kotlin-cache"
kotlin -script my_script.main.kts