CVE-2023-26269 PoC — Apache James 安全漏洞

Description

CVE-2023-26269: Misconfigured JMX in Apache James

介绍

# CVE-2023-26269: Misconfigured JMX in Apache James

By default Apache James opens a JMXRMI service that listens on localhost, port 9999. Because the JMX is misconfigured to allow unauthenticated access, an attacker that has local access to the machine running James can use a [“MLet attack”](https://mogwailabs.de/en/blog/2019/04/attacking-rmi-based-jmx-services/) in order to load arbitrary MBeans and execute malicious Java code.<br/>
Because the application requires elevated privileges to listen on SMTP, POP3, IMAP (25, 110, 143) ports, the application will usually be run as the “root” user increasing the impact of a potential Local Privilege Escalation (LPE) attack.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://lists.apache.org/thread/2z44rg93pflbjhvbwy3xtz505bx41cbs).

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2023-26269/blob/main/Apache%20James%20-%20CVE-2023-26269.pdf).

文件快照

备注