CVE-2025-30761：A vulnerability in JDK's Nashorn Allows for Arbitrary Code Execution

["liyajie" <liyajie () openeuler sh>]

Hello,
 
There is a security vulnerability in Nashorn within the JDK, which can be exploited to access any Java object in a 
restricted Nashorn execution environment (specifically, it refers to the use of --no-java or ClassFilter),thereby 
achieving arbitrary code execution.
 
Details:
- CVE: CVE-2025-30761
- Subsystem: JDK Nashorn
- Impact: Bypassing security restrictions in a restricted Nashorn execution environment, accessing any Java object, and 
achieving arbitrary code execution
- Affected versions: Oracle Java SE: 8u451, 8u451-perf, 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14
- Fixed in: It is recommended to upgrade to a JDK version that includes the fix patch.
 
Description:
In JDK8 - JDK14, Nashorn has always been the built-in JavaScript Engine for Java.
It not only allows dynamic parsing of js in Java, but also allows access to Java classes from within js.
 
```
ScriptEngine engine0 = new ScriptEngineManager().getEngineByName("nashorn");
String cmd = "Java.type('java.lang.Runtime').getRuntime().exec('calc');";
engine0.eval(cmd);
```
 
This code will execute the calc system command and bring up the calculator.
For enhance security, in Nashorn's documentation, there is a `--no-java` option that prohibits access to Java classes 
from JavaScript.
 
```
System.setProperty("nashorn.args", "--no-java");
ScriptEngine engine0 = new ScriptEngineManager().getEngineByName("nashorn");
String cmd = "Java.type('java.lang.Runtime').getRuntime().exec('calc');";
engine0.eval(cmd);
```
 
This code will throw an exception:"Java" is not defined
The researcher discovered a way to bypass the --no-java security restriction, allowing unrestricted access to Java 
objects and the execution of arbitrary code. It is worth mentioning that this bypass way also applies to ClassFilter, 
another security mechanism added to Nashorn by the JDK in JEP202.
 
Credit:
Tianyi Cheng(chengtianyi () huawei com)
 
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-30761
https://www.oracle.com/security-alerts/cpujul2025.html
 
Best regards,
Yajie Li