CVE-2023-22043

What it actually does

Flaw in JavaFX component of Oracle Java SE 8u371 permits unauthenticated network attackers to bypass sandbox restrictions and perform unauthorized creation, deletion, or modification of critical data when untrusted code executes in sandboxed Web Start applications or applets.

Why it matters to the business

Organizations using Java for client-side execution of untrusted code face risk of data integrity loss, potentially enabling tampering with critical information accessible to the Java process without authentication.

How an attack unfolds

An attacker identifies systems running the affected Java SE version with JavaFX enabled, delivers malicious content via network protocols to trigger sandboxed execution of untrusted code, and leverages the flaw to gain write access to data that should be protected by the sandbox.

How to fix it

Upgrade affected Oracle Java SE installations beyond version 8u371 to a release containing the fix for this JavaFX issue. Disable or remove JavaFX where client-side untrusted code execution is not required, and avoid deploying sandboxed Java applets or Web Start applications that load code from untrusted sources.

How to confirm the fix worked

Confirm Java version reports a fixed release, review sandbox policy configurations to ensure untrusted code cannot perform data modifications, and test execution of sample untrusted code to verify integrity protections remain enforced.

Typical attack path

1. Locate targets executing vulnerable Oracle Java SE 8u371 with JavaFX in client environments
2. Serve malicious applet or Web Start application over network protocols
3. Trigger execution within the Java sandbox relying on untrusted code
4. Exploit the JavaFX authorization bypass to modify critical data

How to detect it

Review application and system logs for JavaFX component activity involving network-sourced content, correlate with unexpected data modification events in client processes, and inspect for execution of sandboxed Java applications from external origins.

What your security team should do

• Prioritize inventory of all Oracle Java SE 8u371 deployments and schedule upgrades
• Disable JavaFX and sandboxed applet/Web Start functionality unless explicitly required
• Implement network controls to restrict delivery of untrusted Java content to client systems
• Monitor for any remaining legacy Java client usage and plan migration to non-Java alternatives