Apache Jackrabbit Vulnerability: Risk of Arbitrary Code Execution Attacks
A critical security vulnerability has been identified in Apache Jackrabbit, a widely used open-source content repository for enterprise content management systems and web applications. This flaw, tracked as JCR-5135, is classified as a “Deserialization of Untrusted Data” issue, allowing unauthenticated attackers to achieve arbitrary code execution (RCE) on servers running vulnerable versions. The vulnerability arises from the handling of Java Naming and Directory Interface (JNDI) lookups within certain Apache Jackrabbit components. If a deployment is configured to accept JNDI URIs for Java Content Repository (JCR) lookups from untrusted sources, an attacker can exploit this pathway by submitting a malicious JNDI reference. This action can lead to the deserialization of untrusted data from an attacker-controlled source, potentially enabling the execution of arbitrary commands on the server with the application’s privileges.
The vulnerability affects over two decades of releases for two foundational components of the project, specifically Apache Jackrabbit Core (org.apache.jackrabbit:jackrabbit-core) and Apache Jackrabbit JCR Commons (org.apache.jackrabbit:jackrabbit-jcr-commons), with versions ranging from 1.0.0 to 2.22.1 at risk. To mitigate this significant security threat, the Apache Jackrabbit project team has released a patch, urging administrators to upgrade to version 2.22.2 or later. The new version defaults to disabling JCR lookups through JNDI, closing the attack vector for most users. For those requiring this functionality, it must be explicitly enabled through a system property, with a careful security review advised to prevent unvalidated user-supplied data from influencing the JNDI URI. Applying the update is the most effective way to address the threat.
Categories: Security Vulnerability, Software Update, Risk Mitigation
Tags: Apache Jackrabbit, Security Vulnerability, Arbitrary Code Execution, JNDI Lookups, Deserialization, Untrusted Data, Affected Versions, Mitigation, Patch, System Security