CVE-2024-20945: Oracle GraalVM Auth Bypass Vulnerability

CVE-2024-20945 Overview

CVE-2024-20945 is a security vulnerability affecting Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition within the Security component. This vulnerability enables a low-privileged attacker with local access to the infrastructure where the affected products execute to gain unauthorized access to critical data or complete access to all accessible data within the compromised environment.

Critical Impact

Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition accessible data, potentially exposing sensitive application secrets, cryptographic keys, and confidential business information.

Affected Products

• Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1
• Oracle GraalVM for JDK: 17.0.9, 21.0.1
• Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8, 22.3.4
• Oracle JDK and JRE: versions 1.8.0 update 391, 11.0.21, 17.0.9, 21.0.1

Discovery Timeline

• 2024-02-17 - CVE-2024-20945 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-20945

Vulnerability Analysis

This vulnerability resides in the Security component of Oracle Java SE and GraalVM products. The flaw can be exploited through APIs in the specified component, including scenarios where a web service supplies data to the vulnerable APIs. The vulnerability is particularly concerning for Java deployments that run sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code from external sources such as the internet.

The attack requires local access to the infrastructure where the affected Java products execute, along with low-level privileges. While the exploitation complexity is high, successful attacks can lead to complete confidentiality impact, allowing attackers to access all data accessible to the compromised Java environment.

Root Cause

The root cause of CVE-2024-20945 lies within the Security component's handling of certain operations. While Oracle has not disclosed the specific technical details of the vulnerability mechanism, the issue affects how the Security component processes data, potentially allowing information to be leaked through side-channel attacks or improper access control mechanisms within the security subsystem.

Attack Vector

The attack vector for this vulnerability is local, meaning an attacker must have some form of access to the system where Oracle Java SE or GraalVM is running. The exploitation scenario involves:

1. An attacker gains low-privileged access to the target infrastructure
2. The attacker identifies applications using vulnerable Java or GraalVM versions
3. Through interaction with the Security component APIs, either directly or via a web service that passes data to these APIs, the attacker can trigger the vulnerability
4. Successful exploitation results in unauthorized access to sensitive data

The vulnerability can also be exploited through sandboxed Java Web Start applications or Java applets that load untrusted code and rely on the Java sandbox for security boundaries.

Detection Methods for CVE-2024-20945

Indicators of Compromise

• Unusual access patterns to Java Security component APIs from low-privileged processes
• Unexpected data access or exfiltration attempts from Java-based applications
• Anomalous behavior in sandboxed Java applets or Web Start applications

Detection Strategies

• Monitor for unusual API calls to Java Security component functions from unauthorized or unexpected processes
• Implement application-level logging to track access to sensitive data processed by Java applications
• Deploy endpoint detection and response (EDR) solutions to identify suspicious Java process behavior
• Audit system logs for evidence of local privilege abuse targeting Java environments

Monitoring Recommendations

• Enable verbose logging for Java Security Manager operations where applicable
• Monitor file system access patterns for Java processes accessing sensitive configuration or data files
• Implement network monitoring for Java applications that interact with web services to detect anomalous data flows
• Regularly review audit logs for local user activities that interact with Java runtime environments

How to Mitigate CVE-2024-20945

Immediate Actions Required

• Update all Oracle Java SE installations to the latest patched versions (post 8u391, 11.0.21, 17.0.9, 21.0.1)
• Upgrade Oracle GraalVM for JDK beyond versions 17.0.9 and 21.0.1
• Upgrade Oracle GraalVM Enterprise Edition beyond versions 20.3.12, 21.3.8, and 22.3.4
• Review and restrict local access to systems running Java applications processing sensitive data

Patch Information

Oracle has released security patches addressing this vulnerability in the January 2024 Critical Patch Update (CPU). Administrators should apply the latest security patches from Oracle's official channels. Detailed patch information and download links are available in the Oracle Critical Patch Update. Additional guidance for NetApp customers is available via NetApp Security Advisory.

Workarounds

• Restrict local access to systems running vulnerable Java versions to only trusted, necessary users
• Disable or remove Java Web Start and Java applet functionality if not required
• Implement strict network segmentation to limit the impact of potential data exposure
• Consider running Java applications in containerized environments with minimal privileges

# Verify installed Java version and identify if patching is needed
java -version

# Check for multiple Java installations that may need updating
update-alternatives --list java

# For containerized environments, ensure base images use patched Java versions
# Example: Update Docker images to use patched OpenJDK versions
docker pull eclipse-temurin:21.0.2_13-jdk-jammy