Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2023-51518 EUVD-2024-0689GHSA-px7w-c9gw-7gj3

Apache James server: Privilege escalation via JMX pre-authentication deserialisation

Published Feb 27, 2024 · Updated Aug 22, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache James server Package: org.apache.james:james-server Ecosystem: Maven

Description

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.
Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.
Note that by default JMX endpoint is only bound locally.

We recommend users to:
 - Upgrade to a non-vulnerable Apache James version

 - Run Apache James isolated from other processes (docker - dedicated virtual machine)
 - If possible turn off JMX

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache James server ≤ 3.7.4, 3.8 – ≤ 3.8.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • mbadanoiu/CVE-2023-51518 ★ 1 · Jun 3, 2024

    CVE-2023-51518: Preauthenticated Java Deserialization via JMX in Apache James

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.james:james-server < 3.7.5 3.7.5 GHSA-px7w-c9gw-7gj3
Maven org.apache.james:james-server >= 3.8.0, < 3.8.1 3.8.1 GHSA-px7w-c9gw-7gj3

References