CVE-2024-21147:Unauthenticated, network-accessible vulnerability in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition that can allow an attacker to read, modify, or delete data or gain access to data across multiple protocols; affects multiple supported versions of Java SE and GraalVM components; CVSS v3.1 base score 7.4 (High).

splash
Back

Description Preview

The vulnerability affects the Hotspot component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is difficult to exploit but can be triggered by an unauthenticated attacker who can reach exposed interfaces over the network via multiple protocols by supplying crafted data to the APIs of the affected components. Successful exploitation can result in unauthorized creation, deletion, or modification of data, or unauthorized access to all data accessible by the affected products. The issue also applies to Java deployments that load and run untrusted code in sandboxed environments (such as sandboxed Java Web Start applications or applets) that rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 with High Confidentiality and High Integrity impact, and no Availability impact. Affected versions include Oracle Java SE: 8u411, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14, 21.3.10. Oracle has issued advisories in the July 2024 CPU detailing fixes and upgrade paths.

Overview

This vulnerability concerns Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Hotspot) and can be exploited by an unauthenticated attacker with network access to expose, modify, or delete data via multiple protocols, potentially gaining access to all data these products handle. It affects a range of supported Java SE and GraalVM versions and may also impact Java deployments that run untrusted code in sandboxed environments relying on the Java sandbox. The CVSS score indicates a high-severity impact mainly on confidentiality and integrity, with no direct impact on availability.

Remediation

  • Apply Oracle July 2024 CPU patches and upgrade affected products to the fixed releases as published by Oracle for Java SE and GraalVM components.
  • If immediate upgrade is not possible, implement compensating controls:
    • Restrict network exposure of affected Java SE and GraalVM components to trusted networks and hosts.
    • Audit and harden API endpoints that process untrusted data; restrict or disable APIs that accept untrusted input where feasible.
    • Avoid or minimize use of sandboxed Java Web Start applications or applets; disable loading of untrusted code in client environments.
    • Enforce strict input validation and least privilege on services exposed via APIs.
  • Monitor environments for unusual API calls or data access patterns that could indicate exploitation attempts; review security logs and enable relevant detections.
  • Plan and test an upgrade path to supported, patched versions in a controlled manner to reduce downtime.

References

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing: Medium
    Manufacturing
  2. Public Administration: Medium
    Public Administration
  3. Health Care & Social Assistance: Medium
    Health Care & Social Assistance
  4. Finance and Insurance: Medium
    Finance and Insurance
  5. Transportation & Warehousing: Medium
    Transportation & Warehousing
  6. Educational Services: Medium
    Educational Services
  7. Retail Trade: Medium
    Retail Trade
  8. Professional, Scientific, & Technical Services: Medium
    Professional, Scientific, & Technical Services
  9. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  10. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  11. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  12. Utilities: Low
    Utilities
  13. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  14. Accommodation & Food Services: Low
    Accommodation & Food Services
  15. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  16. Information: Low
    Information
  17. Construction: Low
    Construction
  18. Mining: Low
    Mining
  19. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background