CVE-2023-51518 PoC — Apache James server: Privilege escalation via JMX pre-authentication deserialisation

Source

https://github.com/mbadanoiu/CVE-2023-51518

Associated Vulnerability

Title:Apache James server: Privilege escalation via JMX pre-authentication deserialisation (CVE-2023-51518)
Description:Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JMX endpoint is only bound locally. We recommend users to: - Upgrade to a non-vulnerable Apache James version - Run Apache James isolated from other processes (docker - dedicated virtual machine) - If possible turn off JMX

Description

CVE-2023-51518: Preauthenticated Java Deserialization via JMX in Apache James

Readme

# CVE-2023-51518: Preauthenticated Java Deserialization via JMX in Apache James

Apache James distribution prior to release 3.7.5 and 3.8.1 allow privilege escalation via JMX pre-authentication deserialization. Given a deserialization gadget, this could be leveraged as part of an exploit chain that could result in privilege escalation.

<strong>Note:</strong> For Apache James servers running using Java versions <16, the [ysoserial](https://github.com/frohoff/ysoserial) "CommonsBeanutils1" gadget can be used to execute arbitrary system commands. For Java versions >=16, an alternative vector needs to be identified as explained in this [article](https://mogwailabs.de/en/blog/2023/04/look-mama-no-templatesimpl/).

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://james.apache.org/server/feature-security.html).

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2023-51518/blob/main/Apache%20James%20-%20CVE-2023-51518.pdf).

File Snapshot


 [4.0K]  /data/pocs/250cad277935f2771ae761765e12a9656c383b72
├── [347K]  Apache James - CVE-2023-51518.pdf
└── [1.0K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!