CVE-2023-51747 SMTP smuggling in Apache James

What is CVE-2023-51747?

CVE-2023-51747 is a high-severity vulnerability in Apache James server, published on 27 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.

A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.

The patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.

We recommend James users to upgrade to non vulnerable versions.

Weakness: CWE-444, CWE-290, CWE-20

Which versions are affected by CVE-2023-51747?

4 open source packages ship an affected version, including org.apache.james:james-server. It affects 1 product.

Products include Apache James.

How do I fix CVE-2023-51747?

Upgrade org.apache.james:james-server to a fixed version for your release line: 3.7.5 or 3.8.1.

Is CVE-2023-51747 being exploited?

There is no known exploitation of CVE-2023-51747 in the wild and no public exploit code.

Other vulnerabilities in Apache James server

• CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation Critical 9.8
• CVE-2019-0228 Vulnerability that affects org.apache.pdfbox:pdfbox Critical 9.8
• CVE-2021-40525 Sieve file storage vulnerable to path traversal attacks Critical 9.1
• CVE-2023-26269 Apache James server: Privilege escalation through unauthenticated JMX High 7.8
• CVE-2006-2806 Denial of service in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p5q9-86w4-2xr5.