CVE-2024-21235: Oracle GraalVM SQLI Vulnerability

CVE-2024-21235 Overview

CVE-2024-21235 is a vulnerability affecting the Hotspot component within Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This flaw allows unauthenticated attackers with network access to potentially compromise affected Java environments through multiple protocols. Successful exploitation can result in unauthorized data modification and limited unauthorized read access to system data.

The vulnerability is particularly concerning because it can be exploited through APIs in the Hotspot component, including through web services that supply data to these APIs. Additionally, this vulnerability affects Java deployments that run sandboxed Java Web Start applications or sandboxed Java applets that load and execute untrusted code from the internet while relying on the Java sandbox for security boundaries.

Critical Impact

Attackers can achieve unauthorized update, insert, or delete access to accessible data, as well as unauthorized read access to a subset of data within Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition environments.

Affected Products

• Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23
• Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23
• Oracle GraalVM Enterprise Edition: 20.3.15, 21.3.11
• Oracle JRE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23

Discovery Timeline

• 2024-10-15 - CVE-2024-21235 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-21235

Vulnerability Analysis

This vulnerability resides in the Hotspot component of Oracle's Java implementation. The Hotspot JVM is the core virtual machine responsible for executing Java bytecode and performing just-in-time (JIT) compilation. A flaw in this component can have wide-reaching implications as Hotspot handles memory management, garbage collection, and runtime optimization for all Java applications.

The vulnerability requires network access but is considered difficult to exploit due to the high attack complexity involved. No user interaction or prior privileges are required for exploitation, making it potentially dangerous in environments where Java services are exposed to untrusted network traffic.

Root Cause

The specific technical root cause has not been disclosed by Oracle (classified as NVD-CWE-noinfo). However, the vulnerability affects the Hotspot component's handling of operations accessible through network-facing APIs. The flaw allows manipulation of data integrity and confidentiality boundaries when processing requests from unauthenticated sources.

Attack Vector

The attack vector is network-based and can be exploited through multiple protocols. Attackers can leverage:

1. Web services that provide data to Hotspot component APIs
2. Sandboxed Java Web Start applications processing untrusted code
3. Sandboxed Java applets loading code from internet sources

The vulnerability exploits trust assumptions in the Java sandbox security model. When untrusted code is loaded and executed within sandboxed environments, the vulnerability can be triggered to bypass intended access controls, resulting in unauthorized data access or modification.

Detection Methods for CVE-2024-21235

Indicators of Compromise

• Unusual network activity targeting Java-based web services or application servers
• Unexpected data modifications in systems running vulnerable Java versions
• Anomalous API calls to Hotspot component interfaces from untrusted sources
• Signs of sandbox escape attempts in Java Web Start or applet environments

Detection Strategies

• Monitor for unusual patterns in Java application logs, particularly around Hotspot component operations
• Implement network traffic analysis to identify suspicious requests to Java-based services
• Deploy runtime application self-protection (RASP) solutions to detect exploitation attempts against Java environments
• Use vulnerability scanning tools to identify systems running affected Java versions

Monitoring Recommendations

• Enable verbose logging for Java applications to capture API interaction patterns
• Monitor system integrity for unauthorized data modifications in Java-accessible resources
• Configure alerts for unusual process behavior from JVM instances
• Implement network segmentation monitoring to detect lateral movement attempts post-exploitation

How to Mitigate CVE-2024-21235

Immediate Actions Required

• Inventory all systems running Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition
• Prioritize patching systems that expose Java services to untrusted networks
• Disable Java Web Start and Java applets where not required for business operations
• Implement network-level access controls to restrict access to Java-based services

Patch Information

Oracle has released security patches addressing this vulnerability as part of their October 2024 Critical Patch Update. Organizations should update to the following minimum versions:

• Oracle Java SE: Update beyond 8u421, 11.0.24, 17.0.12, 21.0.4, and 23
• Oracle GraalVM for JDK: Update beyond 17.0.12, 21.0.4, and 23
• Oracle GraalVM Enterprise Edition: Update beyond 20.3.15 and 21.3.11

For detailed patch information, refer to the Oracle Security Alert - October 2024. Debian users should also review Debian LTS Advisory #00018 and Debian LTS Advisory #00020.

Workarounds

• Restrict network access to Java-based services using firewall rules to allow only trusted sources
• Disable Java Web Start and Java browser plugins in enterprise environments
• Implement application-level access controls to limit API exposure
• Use Web Application Firewalls (WAF) to filter malicious requests targeting Java services

# Example: Disable Java Web Start association on Linux systems
sudo update-alternatives --remove-all javaws

# Example: Restrict Java network access using iptables (adjust ports as needed)
sudo iptables -A INPUT -p tcp --dport 8080 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP