The JVM Tool Interface [[JVMTI 06]] contains extensive facilities to query the internals of a JVM, including facilities to monitor and modify a running Java program. These low level facilities require the use of the Java Native Interface (JNI) and C language programming. The JVM Tool Interface is typically used by development and monitoring tools.
From the security point of view, the JVMTI provides access to fields that would normally be inaccessible. The interface also provides facilities for changing the behavior of a running Java program (for example, threads can be suspended or stopped). The JVMTI profiling tools can measure the time that a thread takes to execute, leaving applications vulnerable to timing attacks.
Noncompliant Code Example
The JVMTI works by using agents that communicate with the running JVM. These agents are usually loaded at JVM startup via one of the command line options -agentlib or -agentpath.
${JDK_PATH}/bin/java -agentlib:libname ApplicationName
Some JVMs allow agents to be started when the JVM is already running. Also, platforms that support environment variables allow agents to be specified in such variables, although this feature can be disabled where security is a concern. The JVMTI is always enabled by default, and JVMTI agents may run under the default security manager without requiring any permissions to be granted. While JVMTI may be useful for debuggers and profilers, such levels of access may be inappropriate for all users of the system on which the JVM runs.
Compliant Solution
Do not start the JVM on an operational machine with any agents enabled.
${JDK_PATH}/bin/java -Djava.security.manager ApplicationName
Also, it is necessary to disable the environment variable JAVA_TOOL_OPTIONS so that JVMTI agents cannot be specified by this mechanism.
Risk Assessment
Deploying a Java application that can be monitored and modified using the JVM Tool Interface significantly increases the risk of attack.
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
ENV01- J |
low |
unlikely |
medium |
P2 |
L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
[[JVMTI 06]]
[[Long 05]] Section 2.6, The JVM Tool Interface
01. Runtime Environment (ENV) ENV02-J. Do not deploy an application that can be accessed by the Java Platform Debugger Architecture