CVE-2024-21002

What it actually does

The flaw permits an unauthenticated local attacker who obtains a logon to the host to bypass Java sandbox restrictions in JavaFX, resulting in unauthorized modification (insert/update/delete) of limited accessible data when a user interacts with untrusted sandboxed Java Web Start applications or applets.

Why it matters to the business

Low-risk data tampering exposure in client-side Java applications that load untrusted code; limited operational impact given the high exploitation difficulty, requirement for local access, and user interaction, with no known active exploitation or ransomware use.

How an attack unfolds

An attacker with local logon access to a system running vulnerable Java SE 8u401 or GraalVM Enterprise Edition 20.3.13/21.3.9 crafts or supplies malicious JavaFX content inside a sandboxed applet or Web Start application; the victim must interact with the application, allowing the attacker to abuse the JavaFX component and perform unauthorized data modifications within the sandbox.

How to fix it

Apply the latest Oracle Critical Patch Update to upgrade Oracle Java SE beyond 8u401 and Oracle GraalVM Enterprise Edition beyond 20.3.13 or 21.3.9; disable Java Web Start and applet execution where possible; restrict execution of untrusted Java code on client systems.

How to confirm the fix worked

Verify runtime versions via java -version and javaws commands; confirm deployment of the April 2024 or later CPU; test that sandboxed JavaFX applications no longer permit unauthorized data changes under controlled interaction scenarios.

Typical attack path

1. Obtain local logon to the target host running affected Java runtime
2. Deliver or host malicious JavaFX content in a sandboxed Web Start application or applet
3. Trick a user into launching and interacting with the untrusted Java content
4. Trigger the JavaFX authorization bypass to perform limited data modifications

How to detect it

Review system logs for unexpected Java process launches from user-writable directories; examine browser or application logs for Java Web Start or applet invocations of untrusted code; no specific post-exploitation artifacts are reliably available due to the nature of the integrity-only impact.

What your security team should do

• Prioritize patching Java runtimes on all client endpoints within the next maintenance window
• Inventory and restrict use of Java Web Start and applets that load external code
• Monitor Oracle CPU releases for subsequent JavaFX fixes