CVE-2024-21140

What it actually does

The flaw permits an unauthenticated network attacker to achieve limited unauthorized data modification and read access via the Hotspot component APIs.

Why it matters to the business

Organizations face potential data tampering and leakage risks in Java-dependent environments, with heightened urgency for systems using older versions given the 820 days since disclosure and low but persistent exploit probability.

How an attack unfolds

An attacker with network reach crafts requests to exposed Java APIs in the affected component, bypassing intended controls to perform limited unauthorized data operations; no known threat actors or ransomware use reported.

How to fix it

Upgrade affected Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition installations to fixed versions; for gitlab-org/gitlab apply the patches at commits bb522e4e0a729ff96a77a38b40c7e638654d7b95 or 1c964efc9c74e98a604c02dfaed5f4097518ac00.

How to confirm the fix worked

Verify deployed Java and GitLab versions against the listed fixed releases and confirm no vulnerable 8u411, 11.0.23, 17.0.11, 21.0.3, 22.0.1 or equivalent GraalVM releases remain in use.

Typical attack path

1. Identify exposed Java deployments accepting network requests to Hotspot APIs
2. Craft and send malicious API calls without authentication
3. Leverage successful calls to read or alter subsets of accessible data

How to detect it

Examine application and web server logs for unusual API calls to Hotspot-related endpoints that result in unexpected data changes or reads; no specific threat actor indicators available.

What your security team should do

• Prioritize patching Java runtimes and dependent GitLab instances within standard change windows due to the extended disclosure window
• Review network exposure of any Java API endpoints handling untrusted input
• Monitor EPSS trends for any future increase in exploit likelihood