CVE-2011-3556
Oracle Java SE JDK/JRE 7/6u27/5.0u31/1.4.2_33 & JRockit R28.1.4 - RCE via RMI
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2011-3556.
PoCs published by Metasploit, sk4la, mihi, hdm, including Metasploit module auxiliary/scanner/misc/java_rmi_server.
AI-analyzed exploit summary This Metasploit module exploits CVE-2011-3556 by leveraging insecure default RMI configurations to execute arbitrary Java code via remote class loading. It crafts a malicious RMI packet to trigger payload delivery over HTTP.
Description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.
Exploits (4)
This Metasploit module exploits CVE-2011-3556 by leveraging insecure default RMI configurations to execute arbitrary Java code via remote class loading. It crafts a malicious RMI packet to trigger payload delivery over HTTP.
This is a Python 3 implementation of a proof-of-concept exploit for CVE-2011-3556, a vulnerability in Java RMI servers. It allows remote code execution by loading a malicious JAR file from an attacker-controlled HTTP server.
This Metasploit module scans for Java RMI endpoints and checks if remote class loading is enabled, which could lead to remote code execution. It does not contain offensive payloads but detects vulnerable configurations.
This Metasploit module exploits a Java RMI server's insecure default configuration (CVE-2011-3556) to achieve remote code execution by leveraging the RMI Distributed Garbage Collector to load malicious classes from a remote HTTP server.