Apache James vulnerable to STARTTLS command injection (IMAP and POP3)

Vulnerability

Apache James prior to release 3.6.1 is vulnerable to a buffering attack that leverages the STARTTLS command in SMTP, IMAP, and POP3 protocols. The vulnerability allows an attacker to inject commands during the TLS negotiation handshake by exploiting the buffering of plaintext commands before TLS is established. This issue is tracked as JAMES-1862 [1][2][3][4].

Exploitation

For SMTP exploitation, no prior authentication is required. For IMAP, a local account is needed; POP3 exploitation can compromise data integrity. An attacker with man-in-the-middle (MITM) network position can intercept the unencrypted STARTTLS command and inject commands that are processed before the TLS session begins, leading to command injection [1][3][4].

Impact

Successful exploitation results in MITM command injection attacks that can lead to leakage of sensitive information such as user credentials. Data integrity may be compromised in POP3 sessions [1][3][4].

Mitigation

Upgrade to Apache James 3.6.1 or later to fix the vulnerability. As a workaround, if possible, disable STARTTLS and rely solely on explicit TLS for SMTP, IMAP, and POP3 [1][3][4].