Skip to main content

Deserialization of Untrusted Data

CVE-2023-37895

High
9.8/10

Summary

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions through 2.20.10 and 2.21.0 through 2.21.17 use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Note that earlier stable branches have been EOLd already and do not receive updates anymore. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases. How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit "webapp/standalone". The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like "netstat" can be used to check. RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running standalone on port 8080, check whether an HTTP GET request on "localhost:8080/rmi" returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control. Turning off RMIFind "web.xml" (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet: " <servlet> <servlet-name>RMI</servlet-name> <servlet-class>org.apache.jackrabbit.servlet.remote.RemoteBindingServlet</servlet-class> </servlet> " and "<servlet-mapping> <servlet-name>RMI</servlet-name> <url-pattern>/rmi</url-pattern> </servlet-mapping> ". Find the bootstrap.properties file (in "$REPOSITORY_HOME"), and set "rmi.enabled=false" and also remove "rmi.host", "rmi.port" and "rmi.url-pattern". If there is no file named "bootstrap.properties" in "$REPOSITORY_HOME", it is located somewhere in the classpath. In this case, place a copy in "$REPOSITORY_HOME" and modify it as explained.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-502 - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerabilities enable an attacker to replace or manipulate a serialized object, replacing it with malicious data. When the object is deserialized at the victim's end the malicious data is able to compromise the victim’s system. The exploit can be devastating, its impact may range from privilege escalation, broken access control, or denial of service attacks to allowing unauthorized access to the application's internal code and logic which can compromise the entire system.

References

Advisory Timeline

  • Published