CVE-2017-12815
📋 TL;DR
CVE-2017-12815 is a critical path traversal vulnerability in Bomgar Remote Support Portal's JavaStart.jar applet that allows arbitrary file operations on the client system. Attackers can host malicious websites that exploit the vulnerable Java applet to create, modify, or delete files with the privileges of the user running Java. This affects all users accessing Bomgar Remote Support Portal deployments with vulnerable JavaStart.jar applets.
💻 Affected Systems
- Bomgar Remote Support Portal
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file write leading to remote code execution, data destruction, or ransomware deployment.
Likely Case
File system manipulation leading to data theft, malware installation, or privilege escalation.
If Mitigated
Limited impact if Java applets are disabled or Bomgar portal is isolated from untrusted networks.
🎯 Exploit Status
Exploitation requires user to visit malicious website with Java enabled; no authentication to Bomgar required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: JavaStart.jar version after 52790
Vendor Advisory: https://www.bomgar.com/support/security-advisories
Restart Required: No
Instructions:
1. Update Bomgar Remote Support Portal to latest version. 2. Ensure JavaStart.jar is updated to version after 52790. 3. Clear browser caches to remove old applet versions.
🔧 Temporary Workarounds
Disable Java in browsers
allPrevent Java applets from running in web browsers
Browser-specific: Disable Java plugin/add-on
Network segmentation
allRestrict access to Bomgar portal to trusted networks only
Firewall rules to limit Bomgar portal access
🧯 If You Can't Patch
- Disable Java applets completely in all user browsers
- Implement strict web filtering to block malicious sites and restrict Bomgar portal access
🔍 How to Verify
Check if Vulnerable:
Check JavaStart.jar version in Bomgar portal at /api/content/JavaStart.jar; versions ≤52790 are vulnerable.Check Version:
curl -I https://[bomgar-domain]/api/content/JavaStart.jar | grep -i 'content-disposition'Verify Fix Applied:
Verify JavaStart.jar version >52790 and test with security scanning tools.📡 Detection & Monitoring
Log Indicators:
- Unusual file operations from Java processes
- Multiple failed Java applet loads
Network Indicators:
- Requests to /api/content/JavaStart.jar from unusual sources
- Java applet traffic to non-Bomgar domains
SIEM Query:
source="web_proxy" AND url="*JavaStart.jar*" AND (user_agent="*Java*" OR method="GET")