CVE-2024-21012: Oracle GraalVM Auth Bypass Vulnerability

CVE-2024-21012 Overview

CVE-2024-21012 is a vulnerability in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This flaw allows an unauthenticated attacker with network access via multiple protocols to compromise affected Java deployments. The vulnerability is difficult to exploit but can result in unauthorized update, insert, or delete access to some accessible data within the affected products.

This vulnerability primarily impacts Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from external sources such as the internet. Environments that rely on the Java sandbox for security isolation are at risk. Server deployments that exclusively run trusted, administrator-installed code are not affected by this vulnerability.

Critical Impact

Attackers can potentially modify or delete data in affected Oracle Java SE and GraalVM deployments through network-based attacks targeting the Networking component.

Affected Products

• Oracle Java SE: 11.0.22, 17.0.10, 21.0.2, 22
• Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22
• Oracle GraalVM Enterprise Edition: 20.3.13, 21.3.9
• Oracle JRE: 11.0.22, 17.0.10, 21.0.2, 22.0.1
• NetApp Active IQ Unified Manager (VMware vSphere and Windows)
• NetApp Data Infrastructure Insights Acquisition Unit
• NetApp Data Infrastructure Insights Storage Workload Security Agent
• NetApp OnCommand Insight
• NetApp OnCommand Workflow Automation
• Debian Linux 10.0

Discovery Timeline

• April 16, 2024 - CVE-2024-21012 published to NVD
• May 21, 2025 - Last updated in NVD database

Technical Details for CVE-2024-21012

Vulnerability Analysis

This vulnerability resides in the Networking component of Oracle's Java platform products. The flaw is classified under CWE-276 (Incorrect Default Permissions), indicating an issue with how permissions are assigned or enforced within the networking functionality. While the vulnerability requires high attack complexity to exploit successfully, it does not require any privileges or user interaction, making it exploitable by unauthenticated remote attackers.

The integrity impact of this vulnerability is limited, meaning attackers can achieve unauthorized modification of some data but cannot affect confidentiality or availability. The sandboxed execution environment that Java Web Start applications and applets operate within is the primary attack surface, as these environments are designed to run untrusted code while relying on sandbox restrictions for security.

Root Cause

The root cause is attributed to incorrect default permissions (CWE-276) in the Networking component. This permission misconfiguration allows operations that should be restricted within the Java sandbox, potentially enabling unauthorized data modification. The flaw affects how the sandboxed networking stack validates or restricts certain operations when processing untrusted code.

Attack Vector

The attack vector is network-based and can be exploited via multiple protocols. An attacker must craft a malicious Java applet or Web Start application that, when executed within a vulnerable sandboxed environment, leverages the permission flaw to perform unauthorized data modifications. The attack requires specific conditions to be met, making exploitation difficult but not impossible for skilled attackers with sustained network access.

The vulnerability mechanism involves the networking component failing to properly enforce permission boundaries, allowing sandboxed code to perform operations beyond its intended restrictions. For detailed technical information, refer to the Oracle Security Alert and NetApp Security Advisory.

Detection Methods for CVE-2024-21012

Indicators of Compromise

• Unusual network activity from Java processes attempting unauthorized data modifications
• Sandboxed Java applications exhibiting unexpected network behavior or permission escalation attempts
• Log entries indicating permission violations in the Java Networking component
• Suspicious Java Web Start or applet executions from untrusted sources

Detection Strategies

• Monitor Java runtime environments for execution of untrusted applets or Web Start applications
• Implement network monitoring to detect anomalous traffic patterns from Java processes
• Audit Java security policy configurations for unexpected permission grants
• Review application logs for networking-related security exceptions or policy violations

Monitoring Recommendations

• Enable verbose security logging for Java runtime environments
• Configure intrusion detection systems to alert on suspicious Java network activity
• Implement file integrity monitoring for Java installation directories and configuration files
• Deploy endpoint detection and response (EDR) solutions to monitor Java process behavior

How to Mitigate CVE-2024-21012

Immediate Actions Required

• Update Oracle Java SE to version 11.0.23, 17.0.11, 21.0.3, or 22.0.1 and later
• Update Oracle GraalVM for JDK to patched versions as specified in Oracle's advisory
• Update Oracle GraalVM Enterprise Edition beyond versions 20.3.13 and 21.3.9
• Disable Java Web Start and applet support if not required for business operations
• Review and restrict execution of untrusted Java code in your environment

Patch Information

Oracle has addressed this vulnerability in the April 2024 Critical Patch Update. Administrators should apply the latest security patches from Oracle's official channels. For detailed patch information and download links, refer to the Oracle Security Alert for April 2024.

NetApp customers should consult the NetApp Security Advisory NTAP-20240426-0004 for guidance on affected NetApp products. Debian users should refer to the Debian LTS Announcement for package updates.

Workarounds

• Disable Java browser plugins and Web Start functionality in enterprise environments where not required
• Configure Java security policies to restrict network access for sandboxed applications
• Implement network segmentation to limit the impact of potential exploitation
• Block untrusted Java applets and Web Start applications at the gateway level
• Use application allowlisting to prevent execution of unauthorized Java applications

# Disable Java Web Start and browser plugin (example for Linux)
# Remove or rename the javaws executable to prevent Web Start execution
sudo mv /usr/lib/jvm/java-11-openjdk-amd64/bin/javaws /usr/lib/jvm/java-11-openjdk-amd64/bin/javaws.disabled

# Configure Java security policy to restrict network permissions
# Edit $JAVA_HOME/lib/security/java.policy to remove or restrict:
# permission java.net.SocketPermission "*", "connect,resolve";