Back Sploitus

CVE-2024-21006_jar exploit

Sploitus • September 16, 2026

Ссылка на exp код:

Здесь исходный код скомпилирован в jar-пакет для удобства использования. В папке lib находятся зависимости. Если вы хотите изменить исходный код, можете скомпилировать его самостоятельно.

java -jar CVE-2024-21006.jar

![](

Со ссылкой на проект мастера dadvlingd, bind случайная строка, решает проблему однократного использования payload.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Exploits for CVE-2024-21006 and CVE-2017-12149 Released Two exploits have been released targeting vulnerabilities CVE-2024-21006 and CVE-2017-12149. CVE-2024-21006, published on April 16, 2024, has a proof-of-concept (PoC) available since July 2, 2024, and is packaged as a JAR file for ease of use. The exploit allows attackers to execute arbitrary code, potentially affecting a wide range of Java applications. Meanwhile, CVE-2017-12149 is a vulnerability in JBoss that can be verified using a command-line tool also packaged as a JAR file. The existence of these exploits raises concerns for organizations using affected systems, as they may be at risk of exploitation if not patched. Current status indicates that both vulnerabilities are known, but the extent of active exploitation remains unclear. 3 sources 54

Extracted Entities

CVEs (1)

CVE-2024-21006

Platforms (1)

Java