CVE-2024-21094: Oracle GraalVM RCE Vulnerability

CVE-2024-21094 Overview

CVE-2024-21094 is a vulnerability in the Hotspot component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This flaw allows an unauthenticated attacker with network access via multiple protocols to potentially compromise data integrity. The vulnerability is difficult to exploit but can be triggered through APIs in the Hotspot component, including via web services that supply data to these APIs.

This vulnerability is particularly concerning for Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from the internet while relying on the Java sandbox for security isolation. The CWE-349 classification indicates this involves acceptance of extraneous untrusted data with trusted data.

Critical Impact

Successful exploitation allows unauthorized update, insert, or delete access to data accessible by Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, potentially compromising data integrity in enterprise environments.

Affected Products

• Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22
• Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22
• Oracle GraalVM Enterprise Edition: 20.3.13, 21.3.9
• NetApp Active IQ Unified Manager (VMware vSphere and Windows)
• NetApp Data Infrastructure Insights Acquisition Unit
• NetApp Data Infrastructure Insights Storage Workload Security Agent
• NetApp OnCommand Insight
• NetApp OnCommand Workflow Automation
• Debian Linux 10.0

Discovery Timeline

• April 16, 2024 - CVE-2024-21094 published to NVD
• May 21, 2025 - Last updated in NVD database

Technical Details for CVE-2024-21094

Vulnerability Analysis

The vulnerability resides in the Hotspot component, which is the core JIT (Just-In-Time) compiler and runtime execution engine of the Java Virtual Machine. The flaw relates to improper handling of data where extraneous untrusted data may be accepted alongside trusted data (CWE-349), creating an integrity risk.

The vulnerability requires network access but has high attack complexity, meaning exploitation conditions are not trivially achievable. No privileges or user interaction are required for the attack, though the scope remains unchanged (contained within the vulnerable component). The impact is limited to integrity violations without confidentiality or availability consequences.

Exploitation can occur through multiple network protocols by leveraging APIs within the Hotspot component. This includes scenarios where a web service supplies data to vulnerable APIs, making server-side Java applications potential targets. Client-side exploitation is possible through sandboxed Java Web Start applications or Java applets that execute untrusted code from the internet.

Root Cause

The root cause stems from CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data. The Hotspot component fails to properly segregate or validate untrusted data when processing alongside trusted data, allowing attackers to inject malicious data that the system incorrectly treats as legitimate. This design weakness in data handling permits unauthorized modifications to accessible data.

Attack Vector

The attack vector is network-based, requiring the attacker to have network connectivity to the target system. Exploitation leverages the Hotspot component's APIs, which can be accessed through various protocols. The attack scenarios include:

• Direct API calls through web services that interface with the Hotspot component
• Delivery of malicious code through sandboxed Java applets or Web Start applications
• Exploitation through applications that process untrusted input via affected Java APIs

The high attack complexity indicates that successful exploitation requires specific conditions beyond basic network access, such as particular runtime configurations or specific data processing patterns.

Detection Methods for CVE-2024-21094

Indicators of Compromise

• Unusual Java process behavior including unexpected data modifications or writes
• Anomalous network connections from Java applications to untrusted external sources
• Unexpected changes to data processed by Java-based applications
• Java runtime exceptions or errors indicating data validation issues in Hotspot operations

Detection Strategies

• Implement application-level logging for all Java API calls processing external data
• Monitor Java process behavior for unauthorized data access patterns using endpoint detection tools
• Deploy network traffic analysis to identify suspicious communication patterns to/from Java services
• Enable Java Security Manager logging to track sandboxed application activities
• Use SentinelOne Singularity to detect and correlate anomalous Java runtime behaviors

Monitoring Recommendations

• Configure centralized logging for all Java-based applications and services
• Establish baseline behavior profiles for Java processes and alert on deviations
• Monitor for attempts to load untrusted applets or Web Start applications
• Track Java version information across the environment to identify unpatched systems

How to Mitigate CVE-2024-21094

Immediate Actions Required

• Update Oracle Java SE to versions newer than 8u401, 11.0.22, 17.0.10, 21.0.2, or 22
• Update Oracle GraalVM for JDK to versions newer than 17.0.10, 21.0.2, or 22
• Update Oracle GraalVM Enterprise Edition to versions newer than 20.3.13 or 21.3.9
• Review and apply security advisories from NetApp for affected products
• Audit systems for Java Web Start or applet usage and disable if not required

Patch Information

Oracle has released patches addressing this vulnerability in the April 2024 Critical Patch Update (CPU). Administrators should consult the Oracle April 2024 Security Alert for specific patch versions and download locations. NetApp customers should review the NetApp Security Advisory NTAP-20240426-0004 for guidance on their products. Debian users should refer to the Debian LTS Announcement for available updates.

Workarounds

• Disable Java Web Start and Java applet functionality in browser environments where feasible
• Implement strict network segmentation to limit Java application exposure to untrusted networks
• Configure Java Security Manager with restrictive policies for applications processing untrusted data
• Use application firewalls to filter and validate data before it reaches Java APIs
• Deploy SentinelOne endpoint protection to monitor and block exploitation attempts

# Configuration example - Disable Java Web Start and applet plugin
# For Windows, disable the Java plugin in browser settings and registry
# For Linux/macOS, remove or rename the Java browser plugin

# Check current Java version
java -version

# Verify installed Java update level matches or exceeds patched versions
# Example: Oracle JDK 8 should be updated beyond 8u401