Sieve file storage vulnerable to path traversal attacks

Vulnerability

Apache James ManagedSieve implementation is vulnerable to path traversal attacks when handling file storage for sieve scripts. This allows an attacker to read and write any file on the filesystem. The vulnerability affects versions before 3.6.1. It is only exploitable if the ManagedSieve service is enabled, which is not the case by default [1][2].

Exploitation

An attacker must have network access to the ManagedSieve service and be able to authenticate or trigger the vulnerability. The path traversal occurs through manipulation of file paths in sieve script storage. No special privileges are needed beyond network access to the service [2].

Impact

Successful exploitation allows reading and writing arbitrary files on the server, potentially leading to information disclosure, modification of sensitive data, or full system compromise depending on the permissions of the James server process [1].

Mitigation

The vulnerability is fixed in Apache James 3.6.1 and higher. As a workaround, disabling the ManagedSieve service mitigates the risk. Distributed and Cassandra-based products are not affected [2]. Note that a related incomplete fix in 3.6.1 was further addressed in 3.6.2 for a similar issue (CVE-2022-22931) [4].