:: Deepquest ::

Oracle Java SE installs a protocol handler in the registry as “HKEY_CLASSES_ROOTjnlpShellOpenCommandDefault” ‘C:Program FilesJavajre1.8.0_131binjp2launcher.exe” -securejws “%1″‘. This can allow allow an attacker to launch remote jnlp files with little user interaction. A malicious jnlp file containing a crafted XML XXE attack can be leveraged to disclose files, cause a denial of service or trigger SSRF. Versions v8u131 and below are affected.