Apache James server: Privilege escalation via JMX pre-authentication deserialization
Moderate severity
GitHub Reviewed
Published
Feb 27, 2024
to the GitHub Advisory Database
•
Updated Feb 27, 2024
Package
Affected versions
<= 3.7.4
>= 3.8.0, < 3.8.1
Patched versions
3.7.5
3.8.1
Description
Published by the National Vulnerability Database
Feb 27, 2024
Published to the GitHub Advisory Database
Feb 27, 2024
Reviewed
Feb 27, 2024
Last updated
Feb 27, 2024
Credits
-
oscerd Analyst
Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.
Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.
Note that by default JMX endpoint is only bound locally.
We recommend users to:
- Upgrade to a non-vulnerable Apache James version
- Run Apache James isolated from other processes (docker - dedicated virtual machine)
- If possible turn off JMX
References