EUVD-2025-21327
GHSA-44c3-38h8-9fh9
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
Analysis
Apache Jackrabbit versions prior to 2.23.2 contain blind XXE (XML External Entity) vulnerabilities in jackrabbit-spi-commons and jackrabbit-core components due to unsafe XML document parsing when loading privilege definitions. An authenticated attacker with low privileges can exploit this to achieve high-impact confidentiality, integrity, and availability compromise. The vulnerability requires user authentication (PR:L) but has no interaction requirement and affects all systems regardless of scope.
Technical Context
The vulnerability exists in Apache Jackrabbit's privilege loading mechanism, which utilizes unsecured XML document builders (likely using DOM or SAX parsers without XXE protections disabled). Jackrabbit is a Java Content Repository implementation following the JCR specification, widely used for content management and document storage. The root cause is CWE-611 (Improper Restriction of XML External Entity Reference), where the XML parser processes external entity declarations without proper validation or DTD processing restrictions. Affected components are jackrabbit-spi-commons (SPI layer) and jackrabbit-core (core repository), indicating the vulnerability affects the foundational XML deserialization during privilege configuration/loading. This is a blind XXE variant, meaning the attacker cannot directly exfiltrate data but can read files, perform SSRF attacks, or cause denial of service through billion laughs/XML bomb attacks.
Affected Products
[{'vendor': 'Apache Software Foundation', 'product': 'Jackrabbit', 'affected_versions': ['< 2.20.17 (Java 8 EOL branch)', '< 2.22.1 (Java 11)', '< 2.23.2 (Java 11, including beta versions)'], 'components': ['jackrabbit-spi-commons', 'jackrabbit-core'], 'fixed_versions': ['2.20.17', '2.22.1', '2.23.2'], 'notes': 'Versions 2.20.16 and earlier are end-of-life and not receiving updates; users must upgrade to a supported branch.'}]
Remediation
[{'type': 'Immediate Patch', 'action': 'Upgrade to one of the following supported versions based on your Java runtime: Apache Jackrabbit 2.20.17 (for Java 8 environments, though Java 8 is EOL), 2.22.1 (for Java 11), or 2.23.2 (for Java 11, recommended for new deployments).'}, {'type': 'Configuration Mitigation (if patch cannot be immediately applied)', 'action': "Restrict XML privilege source to trusted, internal systems only. Implement network-level access controls to limit which systems can load privilege definitions. Disable external DTD processing at the JVM level using system properties: -Dcom.sun.org.apache.xerces.internal.XMLConstants.ACCESS_EXTERNAL_DTD='' and -Dcom.sun.org.apache.xerces.internal.XMLConstants.ACCESS_EXTERNAL_SCHEMA=''."}, {'type': 'Access Control', 'action': 'Audit and minimize the number of accounts with privilege administration or content repository configuration rights, as exploitation requires authentication.'}, {'type': 'Verification', 'action': 'After patching, verify the XML parser configuration in privilege loading code uses XXE-safe defaults (e.g., XMLInputFactory with FEATURE_SECURE_PROCESSING enabled, DTDProcessing.PROHIBIT, or equivalent hardening).'}, {'type': 'Vendor Advisory', 'action': 'Refer to Apache Jackrabbit security advisory at https://jackrabbit.apache.org/security-advisories.html for detailed patch notes and breaking changes.'}]
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | needs-triage | - |
| questing | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
Debian
Bug #1109335| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 2.18.0+r2.14.6-1 | - |
| bookworm | vulnerable | 2.20.3-1 | - |
| forky, sid, trixie | fixed | 2.20.11-1.1 | - |
| (unstable) | fixed | 2.20.11-1.1 | unimportant |
Share
External POC / Exploit Code
Leaving vuln.today