Exploits for CVE-2024-21006 and CVE-2017-12149 Released

• •CVE-2024-21006 has a PoC exploit available since July 2024.
• •CVE-2017-12149 can be checked for vulnerabilities using a specific JAR tool.
• •Organizations using Java applications or JBoss should assess their exposure to these vulnerabilities.

Two exploits have been released targeting vulnerabilities CVE-2024-21006 and CVE-2017-12149. CVE-2024-21006, published on April 16, 2024, has a proof-of-concept (PoC) available since July 2, 2024, and is packaged as a JAR file for ease of use. The exploit allows attackers to execute arbitrary code, potentially affecting a wide range of Java applications. Meanwhile, CVE-2017-12149 is a vulnerability in JBoss that can be verified using a command-line tool also packaged as a JAR file. The existence of these exploits raises concerns for organizations using affected systems, as they may be at risk of exploitation if not patched. Current status indicates that both vulnerabilities are known, but the extent of active exploitation remains unclear.