cnvd - cnvd-2024-26542

cnvd-2024-26542

Vulnerability from cnvd

Title: Apache James权限提升漏洞（CNVD-2024-26542）

Description:

Apache James是美国阿帕奇（Apache）基金会的一个完全用Java编写的开源Smtp和Pop3邮件传输代理和Nntp新闻服务器。

Apache James存在权限提升漏洞，该漏洞是由JMX端点中不安全的反序列化引起的。攻击者可利用此漏洞获得提升的权限。

Severity: 中

Patch Name: Apache James权限提升漏洞（CNVD-2024-26542）的补丁

Patch Description:

Apache James是美国阿帕奇（Apache）基金会的一个完全用Java编写的开源Smtp和Pop3邮件传输代理和Nntp新闻服务器。

Apache James存在权限提升漏洞，该漏洞是由JMX端点中不安全的反序列化引起的。攻击者可利用此漏洞获得提升的权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or

Reference: https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or

Impacted products

Name
['Apache James 3.7.4', 'Apache James >=3.8，<=3.8.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-51518",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-51518"
    }
  },
  "description": "Apache James\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5b8c\u5168\u7528Java\u7f16\u5199\u7684\u5f00\u6e90Smtp\u548cPop3\u90ae\u4ef6\u4f20\u8f93\u4ee3\u7406\u548cNntp\u65b0\u95fb\u670d\u52a1\u5668\u3002\n\nApache James\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531JMX\u7aef\u70b9\u4e2d\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u5f15\u8d77\u7684\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u5f97\u63d0\u5347\u7684\u6743\u9650\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-26542",
  "openTime": "2024-06-14",
  "patchDescription": "Apache James\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u5b8c\u5168\u7528Java\u7f16\u5199\u7684\u5f00\u6e90Smtp\u548cPop3\u90ae\u4ef6\u4f20\u8f93\u4ee3\u7406\u548cNntp\u65b0\u95fb\u670d\u52a1\u5668\u3002\r\n\r\nApache James\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531JMX\u7aef\u70b9\u4e2d\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u5f15\u8d77\u7684\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u5f97\u63d0\u5347\u7684\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache James\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2024-26542\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache James 3.7.4",
      "Apache James \u003e=3.8\uff0c\u003c=3.8.0"
    ]
  },
  "referenceLink": "https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or",
  "serverity": "\u4e2d",
  "submitTime": "2024-03-14",
  "title": "Apache James\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2024-26542\uff09"
}

CVE-2023-51518 (GCVE-0-2023-51518)

Vulnerability from cvelistv5

Published

2024-02-27 09:09

Modified

2024-08-22 20:42

Severity ?

CWE

CWE-502 - Deserialization of Untrusted Data

Summary

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally. We recommend users to: - Upgrade to a non-vulnerable Apache James version - Run Apache James isolated from other processes (docker - dedicated virtual machine) - If possible turn off JMX

References

▼	URL	Tags
	https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or	vendor-advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache James server	Version: 0 ≤ 3.7.4 Version: 3.8 <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:32:10.273Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:james_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "james_server",
            "vendor": "apache",
            "versions": [
              {
                "lessThanOrEqual": "3.7.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "3.8"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-51518",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-22T20:42:32.574252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T20:42:38.254Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache James server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "3.7.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.8.0",
              "status": "affected",
              "version": "3.8",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mal Aware"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Arnout Engelen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\u003cbr\u003eGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\u003cbr\u003e\u003cdiv\u003eNote that by default JMX endpoint is only bound locally.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003eWe recommend users to:\u003cbr\u003e\u003cdiv\u003e\u0026nbsp;- Upgrade to a non-vulnerable Apache James version\u003c/div\u003e\u003cdiv\u003e\u0026nbsp;- Run Apache James isolated from other processes (docker - dedicated virtual machine)\u003cbr\u003e\u0026nbsp;- If possible turn off JMX\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data.\nGiven a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation.\nNote that by default JMX endpoint is only bound locally.\n\nWe recommend users to:\n\u00a0- Upgrade to a non-vulnerable Apache James version\n\n\u00a0- Run Apache James isolated from other processes (docker - dedicated virtual machine)\n\u00a0- If possible turn off JMX\n\n"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-27T09:09:31.579Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/wbdm61ch6l0kzjn6nnfmyqlng82qz0or"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache James server: Privilege escalation via JMX pre-authentication deserialisation",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2023-51518",
    "datePublished": "2024-02-27T09:09:31.579Z",
    "dateReserved": "2023-12-20T16:14:49.938Z",
    "dateUpdated": "2024-08-22T20:42:38.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted