This is pretty interesting because it&#x27;s actually a vuln in JODE, which is used by FireEye&#x27;s devices to decompile and inspect JARs for malicious code.
I&#x27;m curious as to the thought process behind JODE&#x27;s developers when they decided to execute code from the JAR they&#x27;re decompiling, since decompiling is almost always done against untrusted JARs, it seems like an odd move to explicitly execute code from them. Yet another reason to do all your RE in a VM&#x2F;locked down environment. I think it&#x27;s kinda funny that FireEye have made a dedicated environment for scanning malware but aren&#x27;t even taking advantage of basic chroot&#x2F;jail&#x2F;whatever to at least mitigate an RCE such as this.
There&#x27;s also a privilege escalation issue at play here that seems to be non-trivial to fix as it&#x27;s been weeks since disclosure and FireEye has requested more time to fix it. I guess FireEye really doesn&#x27;t want its customers to have root access to their devices? I&#x27;m not sure how the devices are sold, but I suppose if they&#x27;re rented or leased that would make sense.