CVE-2024-20945

What it actually does

A flaw in the Java Security component allows a local low-privileged attacker to bypass sandbox restrictions and read critical data via APIs or untrusted code loaded in sandboxed applications.

Why it matters to the business

Attackers who already have limited access to a system can obtain sensitive information, raising the risk of data exposure on any environment using the affected Java releases.

How an attack unfolds

An attacker with logon access to the host invokes vulnerable Java APIs or supplies untrusted code to a sandboxed application; because the flaw is difficult to trigger, the attack requires precise conditions but can result in full confidentiality compromise of data accessible to the Java process.

How to fix it

Upgrade Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition to the fixed releases published by Oracle for each affected version line.

How to confirm the fix worked

Confirm that running java -version reports a patched build; re-execute any internal test cases that exercise sandboxed code or the Security component to verify the information-disclosure path is closed.

Typical attack path

1. Obtain low-privileged local access to a host running an affected Java version
2. Invoke the vulnerable Security component through local APIs or by loading untrusted code in a sandboxed context
3. Read arbitrary data that should have been protected by the Java sandbox

How to detect it

Search process-creation and file-access logs for Java processes launched by low-privileged accounts that subsequently read files or resources outside their expected scope; correlate with any sandbox policy violations or unexpected use of reflection/security-manager APIs.

What your security team should do

• Prioritize patching of internet-facing or multi-tenant systems first
• Remove or isolate any remaining Java 8u391, 11.0.21, 17.0.9 or 21.0.1 deployments
• Review application code that loads untrusted classes or uses privileged Java APIs