Exploitation Summary
CVE-2013-2423 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 25, 2022, with confirmed use in ransomware campaigns.
EIP tracks 2 public exploits from researchers including Metasploit, Jeroen Frijters, juan vazquez, including a Metasploit module exploits/multi/browser/java_jre17_reflection_types.
AI-analyzed exploit summary This Metasploit module exploits a Java Applet Reflection Type Confusion vulnerability (CVE-2013-2423) in Java 7u17 and earlier. It leverages weak access control in setting final fields on static classes to execute arbitrary code outside the Java Sandbox.
Description
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
Exploits (2)
This Metasploit module exploits a Java Applet Reflection Type Confusion vulnerability (CVE-2013-2423) in Java 7u17 and earlier. It leverages weak access control in setting final fields on static classes to execute arbitrary code outside the Java Sandbox.
This Metasploit module exploits a Java Reflection Type Confusion vulnerability (CVE-2013-2423) in Java 7u17 and earlier, allowing remote code execution by bypassing the Java Sandbox. It uses a crafted JNLP file and applet to trigger the vulnerability, primarily targeting Internet Explorer via ActiveX.
References (17)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N