CVE-2024-21140: NetApp Active IQ Information Disclosure

CVE-2024-21140 Overview

CVE-2024-21140 is an information exposure vulnerability affecting the Hotspot component in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access to potentially gain unauthorized read access to sensitive data and perform unauthorized data modifications within affected Java environments.

The vulnerability is particularly concerning because it can be exploited through multiple network protocols via APIs in the Hotspot component. This includes exploitation through web services that supply data to the affected APIs. Additionally, the vulnerability impacts Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code from the internet, potentially bypassing Java sandbox security controls.

Critical Impact

Attackers can exploit this vulnerability remotely without authentication to gain unauthorized read access to sensitive data and perform unauthorized data modifications in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition environments.

Affected Products

• Oracle JDK: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1
• Oracle JRE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1
• Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1
• Oracle GraalVM Enterprise Edition: 20.3.14, 21.3.10
• NetApp Active IQ Unified Manager (VMware vSphere)
• NetApp BluExp
• NetApp Data Infrastructure Insights Storage Workload Security Agent
• NetApp OnCommand Insight
• NetApp OnCommand Workflow Automation
• NetApp Bootstrap OS / HCI Compute Node

Discovery Timeline

• July 16, 2024 - CVE-2024-21140 published to NVD
• June 18, 2025 - Last updated in NVD database

Technical Details for CVE-2024-21140

Vulnerability Analysis

CVE-2024-21140 resides in the Hotspot component of Oracle Java SE and related GraalVM products. The Hotspot component is the core JVM execution engine responsible for just-in-time (JIT) compilation and runtime optimization. This vulnerability enables information exposure (CWE-200), allowing attackers to access data that should be protected.

The vulnerability requires network access but no authentication or user interaction, making it exploitable in scenarios where Java applications are exposed to network traffic. However, the attack complexity is high, meaning successful exploitation requires specific conditions or additional reconnaissance to achieve.

Successful exploitation results in dual impacts: unauthorized read access to a subset of accessible data (confidentiality breach) and unauthorized ability to update, insert, or delete some accessible data (integrity breach). There is no availability impact associated with this vulnerability.

Root Cause

The root cause of this vulnerability is an information exposure weakness (CWE-200) in the Hotspot component's handling of certain operations. The Hotspot JVM fails to properly restrict access to sensitive data under specific conditions, allowing attackers to extract information or manipulate data through crafted inputs to the affected APIs.

This type of vulnerability typically occurs when:

• The JVM does not adequately validate or sanitize data before processing
• Insufficient access controls are applied to certain internal data structures
• Error handling inadvertently exposes sensitive state information

Attack Vector

The attack vector is network-based and can be exploited through multiple protocols. Attackers can target this vulnerability by:

1. API Exploitation: Sending malicious requests to web services or applications that use the vulnerable Java APIs, passing crafted data to trigger the information exposure
2. Sandboxed Code Execution: Deploying malicious Java applets or Java Web Start applications that users execute within a sandboxed environment, allowing the untrusted code to escape intended sandbox restrictions
3. Direct Network Access: Targeting Java applications accessible over the network that utilize the affected Hotspot component functionality

The vulnerability does not require authentication, meaning any attacker with network access to the target can attempt exploitation. However, the high attack complexity indicates that successful exploitation may require specific environmental conditions or precise timing.

Detection Methods for CVE-2024-21140

Indicators of Compromise

• Unusual Java process behavior or unexpected API calls to Hotspot component functions
• Abnormal network traffic patterns to Java-based web services, particularly requests with malformed or suspicious payloads
• Unexpected data access or modification in systems running vulnerable Java versions
• Anomalous JVM error logs or exceptions related to the Hotspot component

Detection Strategies

• Deploy network intrusion detection systems (NIDS) to monitor for suspicious traffic targeting Java applications
• Implement application-level logging to track API calls and data access patterns in Java-based services
• Use endpoint detection and response (EDR) solutions like SentinelOne Singularity to monitor Java process behavior and detect exploitation attempts
• Monitor for unauthorized Java applet or Web Start application execution in client environments

Monitoring Recommendations

• Enable comprehensive JVM logging to capture Hotspot component activity and potential exploitation attempts
• Configure SIEM rules to alert on unusual patterns of data access in Java applications
• Monitor for deployment or execution of untrusted Java applets or Web Start applications
• Regularly audit systems for vulnerable Java versions using asset inventory and vulnerability management tools

How to Mitigate CVE-2024-21140

Immediate Actions Required

• Update all Oracle Java SE installations to the latest patched versions released in Oracle's July 2024 Critical Patch Update
• Update Oracle GraalVM for JDK and GraalVM Enterprise Edition to patched versions
• Review and update NetApp products (Active IQ Unified Manager, BluExp, OnCommand Insight, OnCommand Workflow Automation) per NetApp security advisory
• Disable Java Web Start and Java applet functionality where not required
• Restrict network access to Java-based services to trusted sources only

Patch Information

Oracle has released security patches addressing this vulnerability as part of the Oracle Critical Patch Update - July 2024. Organizations should apply the following updates:

• Oracle JDK/JRE: Update to versions newer than 8u411, 11.0.23, 17.0.11, 21.0.3, or 22.0.1
• Oracle GraalVM for JDK: Update to versions newer than 17.0.11, 21.0.3, or 22.0.1
• Oracle GraalVM Enterprise Edition: Update to versions newer than 20.3.14 or 21.3.10

NetApp customers should refer to NetApp Security Advisory NTAP-20240719-0008 for specific guidance on affected NetApp products.

Workarounds

• Disable Java Web Start and Java applet support in browsers and client systems if not operationally required
• Implement network segmentation to isolate Java applications from untrusted network traffic
• Apply strict firewall rules to limit access to Java-based web services to known trusted IP addresses
• Consider using Java Security Manager with restrictive policies to limit the capabilities of running Java code (note: Security Manager is deprecated in newer Java versions)

# Example: Disable Java Plugin and Web Start in Java deployment configuration
# Edit deployment.properties file (location varies by OS)
# Windows: %USERPROFILE%\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
# Linux/Mac: ~/.java/deployment/deployment.properties

echo "deployment.webjava.enabled=false" >> deployment.properties
echo "deployment.javaws.enabled=false" >> deployment.properties

# Verify installed Java version
java -version

# Update Java to latest patched version via package manager (example for RHEL/CentOS)
sudo yum update java-1.8.0-openjdk
sudo yum update java-11-openjdk
sudo yum update java-17-openjdk