CVE-2024-20922

What it actually does

The flaw in the JavaFX component permits an unauthenticated local attacker to achieve unauthorized update, insert, or delete operations against some accessible data after successful exploitation that requires human interaction from a non-attacker.

Why it matters to the business

Organizations running affected Oracle Java SE or GraalVM deployments face limited risk of data integrity tampering in client-side sandboxed applications, with low likelihood of material operational impact given the high complexity and prerequisites.

How an attack unfolds

An attacker who can log on locally prepares or supplies a malicious JavaFX application or applet that loads untrusted code; the victim is socially engineered into executing it, after which the flaw is triggered to modify data within the Java sandbox.

How to fix it

Apply the latest Oracle Java SE and GraalVM security updates that resolve the JavaFX issue; replace or upgrade any remaining affected versions such as 8u391, 20.3.12, and 21.3.8. Restrict execution of untrusted Java code where feasible.

How to confirm the fix worked

Confirm installed Java versions exceed the affected releases, review Java deployment configurations to ensure sandbox restrictions remain enforced, and validate that test applications cannot perform unauthorized data changes after updates.

Typical attack path

1. Obtain local logon access to a system running affected Java
2. Craft or obtain a malicious JavaFX application or applet containing untrusted code
3. Induce a user to execute the malicious code via Java Web Start or applet
4. Trigger the vulnerability to perform unauthorized data modifications

How to detect it

Examine local authentication logs, Java process execution records, and application sandbox activity for sequences involving untrusted code loading followed by unexpected data modifications; correlate with user interaction events.

What your security team should do

• Patch all Oracle Java SE and GraalVM instances to current versions
• Disable or restrict Java Web Start and applet execution for untrusted content
• Audit systems for the listed affected products and versions
• Monitor Oracle Critical Patch Updates for subsequent fixes