Exploitation Summary
EIP tracks 3 public exploits for CVE-2012-0500.
PoCs published by Metasploit, including Metasploit module exploits/windows/browser/java_ws_double_quote.
AI-analyzed exploit summary This Metasploit module exploits a flaw in the Java Web Start plugin (CVE-2012-0500) by injecting arbitrary JVM arguments via the -J option, leading to remote code execution. It leverages WebDAV and SMB to deliver a malicious DLL payload.
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Exploits (3)
This Metasploit module exploits a flaw in the Java Web Start plugin (CVE-2012-0500) by injecting arbitrary JVM arguments via the -J option, leading to remote code execution. It leverages WebDAV and SMB to deliver a malicious DLL payload.
This Metasploit module exploits a flaw in Java Web Start (CVE-2012-0500) by injecting a double quote into JNLP parameters, allowing the -XXaltjvm option to load a malicious jvm.dll from a remote UNC path, achieving arbitrary code execution.
This Metasploit module exploits CVE-2012-0500 by injecting arbitrary JVM arguments via the Java Web Start plugin, leveraging the -XXaltjvm option to execute malicious code. It acts as an HTTP server to deliver a crafted JNLP file and DLL payload to vulnerable Java Runtime Environments on Windows.