Page History

The JVM Tool Interface \[[JVMTI 2006|AA. Java References#JVMTI 06]\] provides facilities for querying the internals of a JVM and includes methods for monitoring and modifying the behavior of a running Java program. These low level facilities require the use of the Java Native Interface (JNI) and C language programming. The JVM Tool Interface is typically used by development and monitoring tools. 

From the security point of view, the JVMTI provides access to fields that would normally be inaccessible. The interface also provides facilities for changing the behavior of a running Java program, for example, threads can be suspended or stopped. The JVMTI profiling tools can measure the time that a thread takes to execute, leaving applications vulnerable to timing attacks.

Noncompliant Code Example

The JVMTI works by using agents that communicate with the running JVM. These agents are usually loaded at JVM startup via one of the command line options, -agentlib or -agentpath.

// "libname" is the name of the library to load, or an absolute library path
// "options" are passed to the agent on start-up
${JDK_PATH}/bin/java -agentlib:libname=options ApplicationName

Some JVMs allow agents to be started when the JVM is already running. This is not secure in a production environment. Refer to the JVMTI documentation \[[JVMTI 2006|AA. Java References#JVMTI 06]\] for platform specific information on enabling/disabling this feature. 

Platforms that support environment variables allow agents to be specified in such variables. "Platforms may disable this feature in cases where security is a concern; for example, the Reference Implementation disables this feature on UNIX systems when the effective user or group ID differs from the real ID" \[[JVMTI 2006|AA. Java References#JVMTI 06]\].

Agents may run under the default security manager without requiring any permissions to be granted. While the JVMTI is useful for debuggers and profilers, such levels of access may be inappropriate for all users of the JVM.

Compliant Solution

Do not start the JVM with any agents enabled on a production machine. This compliant solution removes the -agentlib command line argument and installs a security manager, as required by guideline ENV02-J. Create a secure sandbox using a Security Manager.

${JDK_PATH}/bin/java -Djava.security.manager ApplicationName

Also, it is necessary to disable the environment variable JAVA_TOOL_OPTIONS so that JVMTI agents cannot be specified via this route.

Risk Assessment

Deploying a Java application with the JVM Tool Interface enabled can allow an attacker to monitor or modify its behavior.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[JVMTI 2006|AA. Java References#JVMTI 06]\]
\[[Long 2005|AA. Java References#Long 05]\] Section 2.6, The JVM Tool Interface

ENV06-J. Provide a trusted environment and sanitize all inputs      01. Runtime Environment (ENV)      ENV08-J. Do not deploy an application that can be accessed using the Java Platform Debugger Architecture