[<prev] [next>] [day] [month] [year] [list]
Message-ID: <860984fc-1094-4724-3ab9-d948a43d304b@apache.org>
Date: Mon, 26 Feb 2024 17:10:05 +0000
From: Benoit Tellier <btellier@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-51518: Apache James server: Privilege escalation via JMX
pre-authentication deserialisation
Severity: low
Affected versions:
- Apache James server through 3.7.4
- Apache James server 3.8 through 3.8.0
Description:
Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.
Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.
Note that by default JMX endpoint is only bound locally.
We recommend users to:
- Upgrade to a non-vulnerable Apache James version
- Run Apache James isolated from other processes (docker - dedicated virtual machine)
- If possible turn off JMX
Credit:
Mal Aware (reporter)
Arnout Engelen (analyst)
References:
https://james.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-51518
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
