Apache James IMAP vulnerable to a ReDoS

Vulnerability

In Apache James, the IMAP protocol handler uses a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). An authenticated IMAP user can send specially crafted LIST commands that cause the regex engine to backtrack excessively, leading to CPU exhaustion. This affects versions prior to 3.6.1. [1][2]

Exploitation

The attacker must have valid IMAP credentials to authenticate to the server. They then send a series of carefully crafted IMAP LIST commands that trigger the vulnerable regex pattern. No special privileges are needed, only the ability to execute IMAP commands. [1][2]

Impact

Successful exploitation results in a denial of service, consuming excessive CPU resources and potentially making the server unresponsive to legitimate requests. The service may need to be restarted to recover. No data confidentiality or integrity is compromised. [1][2]

Mitigation

Upgrade to Apache James 3.6.1 or later, which replaces the vulnerable regex engine with RE2J, ensuring linear-time execution without backtracking. The fix was released in January 2022. [1][2]