CVE-2024-21094

What it actually does

The flaw in the Hotspot component permits an unauthenticated network attacker to perform unauthorized modification (update/insert/delete) of a limited subset of accessible data through crafted API calls or loaded untrusted code that bypasses intended sandbox protections.

Why it matters to the business

Attackers could alter selected data processed by Java applications, leading to integrity violations that may require investigation, rollback, or remediation of affected records and processes.

How an attack unfolds

An attacker sends specially crafted requests over supported network protocols or supplies malicious code to sandboxed Java environments, leveraging the Hotspot vulnerability to modify targeted data without authentication or user interaction.

How to fix it

Apply the latest vendor patches for Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition as they become available; for listed MySQL packages on Ubuntu 20.04 and 22.04 upgrade to version 8.0.29-0ubuntu0.20.04.2 or 8.0.29-0ubuntu0.22.04.1 respectively.

How to confirm the fix worked

Confirm patched Java runtimes are deployed, review application configurations to restrict untrusted code loading, and test that the reported integrity impact vectors are no longer exploitable.

Typical attack path

1. Identify reachable Java SE or GraalVM deployments exposing Hotspot APIs or accepting untrusted code
2. Craft network requests or load malicious classes targeting the vulnerable component
3. Trigger the authorization bypass to perform unauthorized data modifications
4. Verify or persist the altered data state for further impact

How to detect it

Review application and Java runtime logs for unexpected data modifications originating from network requests or untrusted code execution; correlate with access patterns to Hotspot-related components.

What your security team should do

• Prioritize patching all internet-facing or multi-protocol Java deployments given the network attack vector
• Restrict exposure of Hotspot APIs and sandboxed execution environments to trusted sources only
• Monitor for any downstream dependents that embed the affected Java versions