CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX

What is CVE-2023-26269?

CVE-2023-26269 is a high-severity missing authorization vulnerability in Apache James server, published on 3 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user.

Administrators are advised to disable JMX, or set up a JMX password.

Note that version 3.7.4 onward will set up a JMX password automatically for Guice users.

Weakness: CWE-862

Which versions are affected by CVE-2023-26269?

2 open source packages ship an affected version, including org.apache.james:javax-mail-extension. It affects 1 product.

Products include Apache James.

How do I fix CVE-2023-26269?

Upgrade org.apache.james:javax-mail-extension to 3.7.4 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-26269 being exploited?

There is no known exploitation of CVE-2023-26269 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Apache James server

• CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation Critical 9.8
• CVE-2019-0228 Vulnerability that affects org.apache.pdfbox:pdfbox Critical 9.8
• CVE-2021-40525 Sieve file storage vulnerable to path traversal attacks Critical 9.1
• CVE-2006-2806 Denial of service in n/a High 7.8
• CVE-2022-28220 STARTTLS command injection in Apache JAMES High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w7r6-v4j7-h94w.