CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE

What is CVE-2023-37895?

CVE-2023-37895 is a critical unsafe deserialization vulnerability in Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components), published on 25 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI.

Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore.

In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases.

How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone.

The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like "netstat" can be used to check.

RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control.

Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:

        <servlet>             <servlet-name>RMI</servlet-name>             <servlet-class>org.apache.jackrabbit.servlet.remote.RemoteBindingServlet</servlet-class>         </servlet>

        <servlet-mapping>             <servlet-name>RMI</servlet-name>             <url-pattern>/rmi</url-pattern>         </servlet-mapping>

Find the bootstrap.properties file (in $REPOSITORY_HOME), and set

        rmi.enabled=false

    and also remove

        rmi.host         rmi.port         rmi.url-pattern

 If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained.

Weakness: CWE-502

Which versions are affected by CVE-2023-37895?

12 open source packages ship an affected version, including org.apache.jackrabbit:jackrabbit-standalone, org.apache.jackrabbit:jackrabbit-standalone-components and org.apache.jackrabbit:jackrabbit-webapp. It affects 1 product.

Products include Apache Jackrabbit.

How do I fix CVE-2023-37895?

Upgrade org.apache.jackrabbit:jackrabbit-standalone to a fixed version for your release line: 2.20.11 or 2.21.18.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-37895 being exploited?

There is no known exploitation of CVE-2023-37895 in the wild and no public exploit code.

Other vulnerabilities in Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components)

• CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens Critical 9.3
• CVE-2025-53689 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons High 8.8
• CVE-2016-6801 Apache Jackrabbit Authentication Hijacking Vulnerability High 8.8
• CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies Medium 6.9
• CVE-2025-58782 Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-37895, GHSA-q8cm-3v62-jj79, UBUNTU-CVE-2023-37895.