Exploitation Summary
EIP tracks 2 public exploits for CVE-2010-1423.
PoCs published by Metasploit, including Metasploit module exploits/windows/browser/java_ws_arginject_altjvm.
AI-analyzed exploit summary This Metasploit module exploits CVE-2010-1423 by leveraging improper validation of command-line arguments in Sun Java Web Start. It uses the -J and -XXaltjvm options to execute arbitrary code via a malicious JNLP file served over HTTP, targeting Windows systems with WebDAV Mini-Redirector enabled.
Description
Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method. NOTE: some of these details are obtained from third party information.
Exploits (2)
This Metasploit module exploits CVE-2010-1423 by leveraging improper validation of command-line arguments in Sun Java Web Start. It uses the -J and -XXaltjvm options to execute arbitrary code via a malicious JNLP file served over HTTP, targeting Windows systems with WebDAV Mini-Redirector enabled.
This Metasploit module exploits CVE-2010-1423 by leveraging the -J and -XXaltjvm options in Java Web Start to inject arbitrary command-line arguments, leading to remote code execution. It uses a combination of HTTP server functionality and WebDAV Mini-Redirector to deliver a malicious DLL payload.