Java Deployment Toolkit Performs Insufficient Validation of Parameters
-------------------------------------------------------------------------
Java Web Start (henceforth, jws) provides java developers with a way to let
users launch and install their applications using a URL to a Java Networking
Launching Protocol (.jnlp) file (essentially some xml describing the
program).
Since Java 6 Update 10, Sun has distributed an NPAPI plugin and ActiveX control
called "Java Deployment Toolkit" to provide developers with a simpler method
of distributing their applications to end users. This toolkit is installed by
default with the JRE and marked safe for scripting.
The launch() method provided by the toolkit object accepts a URL string, which
it passes to the registered handler for JNLP files, which by default is the
javaws utility.
$ cmd /c ver
Microsoft Windows XP [Version 5.1.2600]
$ java -version
java version "1.6.0_19"
Java(TM) SE Runtime Environment (build 1.6.0_19-b04)
Java HotSpot(TM) Client VM (build 16.2-b04, mixed mode, sharing)
$ cat /proc/registry/HKEY_LOCAL_MACHINE/SOFTWARE/Classes/JNLPFile/Shell/Open/Command/\@
"C:\Program Files\Java\jre6\bin\javaws.exe" "%1"
The toolkit provides only minimal validation of the URL parameter, allowing us
to pass arbitrary parameters to the javaws utility, which provides enough
functionality via command line arguments to allow this error to be exploited.
The simplicity with which this error can be discovered has convinced me
that releasing this document is in the best interest of everyone except
the vendor.
--------------------
Affected Software
------------------------
All versions since Java SE 6 update 10 for Microsoft Windows are believed to be
affected by this vulnerability. Disabling the java plugin is not sufficient to
prevent exploitation, as the toolkit is installed independently.
http://java.sun.com/javase/6/docs/technotes/guides/jweb/deployment_advice.html
I believe non-Windows installations are unaffected.
--------------------
Consequences
-----------------------
Exploitation of this issue is not terribly exciting, but is potentially of high
enough impact to merit explanation. The javaws application supports the
following command line parameters.
$ javaws -help
Usage: javaws [run-options] <jnlp-file>
javaws [control-options]
where run-options include:
-verbose display additional output
-offline run the application in offline mode
-system run the application from the system cache only
-Xnosplash run without showing a splash screen
-J<option> supply option to the vm
-wait start java process and wait for its exit
control-options include:
-viewer show the cache viewer in the java control panel
-uninstall remove all applications from the cache
-uninstall <jnlp-file> remove the application from the cache
-import [import-options] <jnlp-file> import the application to the cache
import-options include:
-silent import silently (with no user interface)
-system import application into the system cache
-codebase <url> retrieve resources from the given codebase
-shortcut install shortcuts as if user allowed prompt
-association install associations as if user allowed prompt
Perhaps the most interesting of these is -J, and the obvious attack is simply
to add -jar followed by an attacker controlled UNC path to the jvm command
line, which I've demonstrated below. Other attacks are clearly possible, but
this is sufficient to demonstrate the problem.
In order to trigger this attack in Internet Explorer, an attacker would use a
code sequence like this
/* ... */