Deserialization Flaw in Java Runtime Environment Used by Sun Products

CVE-2008-5353

Summary

The Java Runtime Environment for certain Sun JDK versions suffers from a deserialization flaw that fails to properly enforce the context of ZoneInfo objects. This vulnerability enables remote attackers to execute untrusted applets and applications with elevated privileges, potentially leading to unauthorized access or manipulation of system resources. Attackers can exploit this issue by deserializing specially crafted Calendar objects, compromising the security integrity of affected environments.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2008-5353
Created by Rapid7

References