Understanding Java RMI: Implementation and Security Considerations
What is RMI?
Remote Method Invocation (RMI) is a Java-native mechanism that enables method calls between different JVM processes. Unlike generic RPC frameworks, RMI is purpose-built for Java environments, allowing objects in one virtual machine to invoke methods on objects residing in another JVM across the network.
The communication backbone o ...
Posted on Tue, 15 Sep 2026 16:39:08 +0000 by Mr Camouflage
Error Handling and Security Features in Java
Error Handling
Aplications should catch org.xml.sax.SAXNotRecognizedException when setting new properties to ensure compatibility with older versions that may not support these properties. For instance, a method checkPropertySupport can determine if the current JDK version supports a specific property like JDK_GENERAL_ENTITY_SIZE_LIMIT:
public ...
Posted on Mon, 17 Aug 2026 16:20:14 +0000 by shortj75
RMI Deserialization Attack Analysis (2)
After the previous analysis of the complete process, we now have a better understanding of RMI.
This article focuses on JDK versions prior to JEP 290, specifically JDK 8u66, where no filtering is applied. It analyzes all possible attack methods. The next article will specifically discuss bypass techniques.
The perspective here is that of an att ...
Posted on Sun, 21 Jun 2026 17:21:57 +0000 by grant777
Advanced RMI Exploitation After JEP 290 Implementation
Understanding JEP 290
JEP 290 was introduced in updates such as JDK 6u141, JDK 7u131, and JDK 8u121 to mitigate deserialization risks. Its core features include:
Implementation of class restriction mechanisms (whitelists or blacklists).
Limitations on the depth and complexity of deserialization graphs.
Introduction of class validation specific ...
Posted on Sat, 30 May 2026 20:45:23 +0000 by Robban