CVE-2024-21002: Oracle GraalVM Auth Bypass Vulnerability

CVE-2024-21002 Overview

CVE-2024-21002 is a security vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition affecting the JavaFX component. This vulnerability involves insecure default permissions (CWE-276) that could allow an unauthenticated attacker with local access to the infrastructure to perform unauthorized data modifications.

The vulnerability specifically impacts Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from the internet while relying on the Java sandbox for security isolation. Server-side Java deployments that only execute trusted, administrator-installed code are not affected by this vulnerability.

Critical Impact

An attacker with local access could gain unauthorized update, insert, or delete access to accessible data within Oracle Java SE and Oracle GraalVM Enterprise Edition environments running sandboxed untrusted code.

Affected Products

• Oracle Java SE: 8u401 (JDK and JRE)
• Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9
• NetApp Active IQ Unified Manager (VMware vSphere and Windows)
• NetApp Data Infrastructure Insights Acquisition Unit
• NetApp Data Infrastructure Insights Storage Workload Security Agent
• NetApp OnCommand Insight
• NetApp OnCommand Workflow Automation

Discovery Timeline

• April 16, 2024 - CVE-2024-21002 published to NVD
• May 29, 2025 - Last updated in NVD database

Technical Details for CVE-2024-21002

Vulnerability Analysis

This vulnerability exists within the JavaFX component of Oracle Java SE and Oracle GraalVM Enterprise Edition. The flaw stems from improper permission handling that can be exploited when untrusted code is executed within the Java sandbox environment.

Successful exploitation requires several conditions to be met: the attacker must have logon access to the local infrastructure where the vulnerable Java installation executes, the attack has high complexity due to specific conditions that must be present, and human interaction from a victim is required. These constraints significantly reduce the attack surface, making exploitation difficult in practice.

The impact is limited to integrity violations—specifically unauthorized modification, insertion, or deletion of accessible data. There is no impact to confidentiality or availability of the affected systems.

Root Cause

The vulnerability is classified under CWE-276 (Incorrect Default Permissions). This indicates that the JavaFX component sets overly permissive default access controls on resources, which can be leveraged by malicious sandboxed code to perform unauthorized data operations that should be restricted by the Java security sandbox.

Attack Vector

Exploitation requires local access to a system running a vulnerable Oracle Java SE or GraalVM Enterprise Edition installation. The attack scenario involves:

1. An attacker must have logon credentials to the target infrastructure
2. The target system must be running sandboxed Java applications (such as Java Web Start or Java applets) that load untrusted code
3. The attacker must craft malicious code that exploits the permission misconfiguration in JavaFX
4. A user other than the attacker must interact with the system (human interaction required)
5. If successful, the attacker can modify, insert, or delete accessible data within the Java environment

This vulnerability does not affect server deployments that exclusively run trusted code installed by administrators. The attack complexity is high due to the specific runtime conditions required for successful exploitation.

Detection Methods for CVE-2024-21002

Indicators of Compromise

• Unexpected modifications to data accessible by sandboxed Java applications
• Unusual Java Web Start or applet activity attempting to access or modify protected resources
• Anomalous JavaFX component behavior or unexpected permission requests from sandboxed code

Detection Strategies

• Monitor for execution of Java Web Start applications or Java applets from untrusted sources
• Implement application whitelisting to restrict execution of sandboxed Java code
• Review Java Security Manager logs for permission violations or suspicious access patterns
• Deploy endpoint detection solutions to identify unauthorized data modification attempts by Java processes

Monitoring Recommendations

• Enable verbose logging for Java Security Manager events
• Monitor file system integrity for data accessible by Java applications
• Track Java runtime version information across enterprise systems to identify unpatched installations
• Alert on execution of javaws or applet viewers loading content from external sources

How to Mitigate CVE-2024-21002

Immediate Actions Required

• Update Oracle Java SE to a version newer than 8u401
• Update Oracle GraalVM Enterprise Edition beyond versions 20.3.13 and 21.3.9
• Disable Java Web Start and Java applet functionality if not required for business operations
• Restrict local logon access to systems running Java deployments that process untrusted code

Patch Information

Oracle has addressed this vulnerability in their April 2024 Critical Patch Update. Organizations should apply the relevant patches as follows:

• Review the Oracle Critical Patch Update Advisory for official patch details
• NetApp customers should consult the NetApp Security Advisory for product-specific guidance
• Ensure all affected Oracle Java SE and GraalVM installations are updated to patched versions

Workarounds

• Disable Java Web Start and Java browser plug-in functionality on systems where it is not required
• Configure Java deployment rules to block execution of untrusted applets and Web Start applications
• Restrict network access for systems running sandboxed Java applications to minimize exposure to malicious code
• Implement strict application control policies to prevent unauthorized Java code execution

# Disable Java Web Start and browser plugin via deployment configuration
# Create or modify deployment.properties file
mkdir -p ~/.java/deployment
echo "deployment.webjava.enabled=false" >> ~/.java/deployment/deployment.properties
echo "deployment.insecure.jres=NEVER" >> ~/.java/deployment/deployment.properties