Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to?

My understanding is that a Java applet can run either in sandbox mode or privileged mode. Only certified applets can run in privileged mode and uncertified ones CAN run in privileged mode but it has to request access from the user. However, this question implies it can use the browsers cache to escalate it's privileges.

The only thing I can think of is that the applet request access via the browser. The user can accept or decline this request and that approval is stored by the browser to determine privileges to the applet. If you could get at that cached data with the applet, you could alter the information and trick the browser into thinking it has been granted privileged access. Therefore allowing the applet to cause damage to the system.


closed as too broad by Adi, Xander, TildalWave, scuzzy-delta, rook Nov 16 '13 at 20:43

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    This is in danger of being too broad. – rook Nov 16 '13 at 5:42
  • Well, that sucks b/c this is a test question on my upcoming exam... – chanpod Nov 16 '13 at 18:00
  • Hundreds of these exploits have been written using dozens of known attack patterns, anything form memory corruption exploits such as buffer overflows and use-after-free against the JVM to logic flaws and trust boundary violations. There is more than one way to skin a cat. – rook Nov 16 '13 at 19:34

All the security measures you describe are from a perfect world. In real world, people make software, people make mistake, so software have bugs and some of them open breaches in this security scheme and can be exploited. This can be for instance exploits affecting the JRE, or the browser executing the applet.

You may google for tems like "Java applet exploit" to have some example of such threats which have been detected and solved in software updates.

To go a bit further, Java applet threat is often more sensible than, let's say, Javascript because Java is both a far more complex technology (the more complex, the more error and exploits) and a far more complete (offers more power over the host once exploited).

  • well, this is a test question on an upcoming exam. So, let's assume a perfect world. how would a malicious applet use a browsers local cache to gain privileges it shouldn't. – chanpod Nov 16 '13 at 18:56
  • @chanpod: When I look at your question (the first paragraph), I may understand that this question less concerns the technical mean how a Java Applet could gain more privilege ("There is more than one way to skin a cat." as Rook said), but once the Java applet has gained more privileges what usage it may do of this information (for instance accessing to full browsing of the user, collecting personal or sensitive data, modifying a cached page to inject malicious content). – WhiteWinterWolf Nov 18 '13 at 15:17
  • Ok, I suppose I'll modify my question. Can an applet access all aspects of a cached web page? In other words, cookies, form data, etc? – chanpod Nov 19 '13 at 4:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.