CVE-2017-3241

CRITICAL

Oracle Java SE 6u131, 7u121, 8u112; Java SE Embedded 8u111; JRockit R28.3.12 - Remote Code Execution via RMI

Title source: llm

Exploitation Summary

EIP tracks 3 public exploits for CVE-2017-3241. PoCs published by ERPScan, xfei3, scopion.

AI-analyzed exploit summary This exploit generates a malicious serialized Java object that triggers a StackOverflowError during deserialization, causing a Denial of Service (DoS) in OpenJDK Runtime Environment 1.8. The PoC crafts a sequence of bytes that exploits a flaw in ObjectInputStream.skipCustomData().

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).

Exploits (3)

exploitdb WORKING POC VERIFIED

by ERPScan · pythondosmultiple

https://www.exploit-db.com/exploits/41145

View Code ZIP pw:eip

This exploit generates a malicious serialized Java object that triggers a StackOverflowError during deserialization, causing a Denial of Service (DoS) in OpenJDK Runtime Environment 1.8. The PoC crafts a sequence of bytes that exploits a flaw in ObjectInputStream.skipCustomData().

Classification

Working Poc 100%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: OpenJDK Runtime Environment 1.8.0_112-b15

No auth needed

Prerequisites: Python 2.x · Target application using vulnerable OpenJDK version

MITRE ATT&CK

T1499.004 - Application or System Exploitation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec WRITEUP 2 stars

by xfei3 · poc

https://github.com/xfei3/CVE-2017-3241-POC

View Code ZIP pw:eip

This repository provides a conceptual proof-of-concept for CVE-2017-3241, a Java RMI deserialization vulnerability. It explains the vulnerability's root cause and references external resources for exploitation techniques but does not include executable exploit code.

Classification

Writeup 90%

Attack Type

Deserialization

Complexity

Moderate

Reliability

Theoretical

Target: Java RMI (JDK 8 and earlier)

No auth needed

Prerequisites: Target must be running a vulnerable Java RMI service · Attacker must be able to send crafted serialized objects to the target

MITRE ATT&CK