CVE-2012-4681
CRITICAL KEV RANSOMWAREJava 7 Applet Remote Code Execution
Title source: metasploitExploitation Summary
CVE-2012-4681 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022, with confirmed use in ransomware campaigns.
EIP tracks 4 public exploits from researchers including Metasploit, benjholla, ZH3FENG, including a Metasploit module exploits/multi/browser/java_jre17_exec.
AI-analyzed exploit summary This Metasploit module exploits a Java 7 vulnerability (CVE-2012-0547) to achieve remote code execution by delivering a malicious JAR file via an HTML page with an embedded applet. The exploit bypasses the Java sandbox and has been tested across multiple browsers and platforms.
Description
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
Exploits (4)
This Metasploit module exploits a Java 7 vulnerability (CVE-2012-0547) to achieve remote code execution by delivering a malicious JAR file via an HTML page with an embedded applet. The exploit bypasses the Java sandbox and has been tested across multiple browsers and platforms.
This repository contains a working proof-of-concept exploit for CVE-2012-4681, a Java vulnerability that bypasses security restrictions to execute arbitrary commands. The exploit uses reflection and Java beans to disable the security manager and execute 'calc.exe' as a demonstration.
This PoC exploits CVE-2012-4681, a Java sandbox bypass vulnerability in JDK7u6, by manipulating the AccessControlContext to disable the SecurityManager. It demonstrates how to reset the Java sandbox using reflection and the `sun.awt.SunToolkit` class.
This Metasploit module exploits CVE-2012-4681, a vulnerability in Java 7 that allows remote code execution by bypassing the Security Manager via ClassFinder and MethodFinder.findMethod(). It delivers a malicious JAR file through an HTML page with an embedded applet.
References (14)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H