PT-2023-5558 · Apache+1 · Commons-Beanutils+2

Manfred Baedke + 2 · Published 2023-06-30 · Updated 2025-09-09 · CVE-2023-37895

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Jackrabbit versions 2.20.10 and earlier (stable branch) Apache Jackrabbit versions 2.21.17 and earlier (unstable branch)

Description A Java object deserialization issue in Apache Jackrabbit webapp/standalone on all platforms allows an attacker to remotely execute code via RMI. The issue is related to the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath.

The native RMI protocol by default uses port 1099. RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". To check whether RMI support is enabled, tools like "netstat" can be used to check the native RMI protocol, and an HTTP GET request can be used to check RMI-over-HTTP.

Recommendations To resolve the issue for versions 2.20.10 and earlier (stable branch), update to version 2.20.11. To resolve the issue for versions 2.21.17 and earlier (unstable branch), update to version 2.21.18. As a temporary workaround, consider disabling RMI access altogether by removing the declaration and the mapping definition for the RemoteBindingServlet in the web.xml file and setting rmi.enabled=false in the bootstrap.properties file.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-06209

CVE-2023-37895

GHSA-Q8CM-3V62-JJ79

Affected Products

Apache Jackrabbit

Debian

Commons-Beanutils

References · 26

• https://security-tracker.debian.org/tracker/CVE-2023-37895 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-37895 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-37895 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8cm-3v62-jj79 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-37895 · Security Note
• https://bdu.fstec.ru/vul/2023-06209 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-37895 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37895 · Security Note
• https://lists.apache.org/thread/j03b3qdhborc2jrhdc4d765d3jkh8bfw · Vendor Advisory
• https://lists.apache.org/list.html?[e-mail] · Vendor Advisory
• https://github.com/apache/jackrabbit · Note
• https://t.me/pentestingnews/38010 · Telegram Post
• https://twitter.com/dailytechonx/status/1965279000848109867 · Twitter Post
• http://seclists.org/fulldisclosure/2023/Jul/43 · Note