Path traversal in Apache James 3.6.1

Vulnerability

CVE-2022-22931 is a path traversal vulnerability in Apache James (Java Apache Mail Enterprise Server) versions prior to 3.6.2. The fix for CVE-2021-40525 failed to properly prepend delimiters upon valid directory validations, affecting the maildir mailbox store and Sieve file repository implementations. This allows an authenticated user to access other users' data stores, limited to user names prefixed by the value of the attacker's username [1][2][3].

Exploitation

An attacker must be an authenticated user of the Apache James server. The exploitation requires no special privileges beyond standard user access. By crafting requests that exploit the improper directory validation, an attacker can traverse directories to access files belonging to other users. The vulnerability is limited to instances where the target username starts with the same prefix as the attacker's username [3].

Impact

Successful exploitation leads to unauthorized access to other users' mailbox data or Sieve scripts, amounting to information disclosure and potential compromise of email content and filtering rules. The attacker can read or potentially manipulate data within the scope of the accessed user's store [2][3].

Mitigation

The vulnerability is fixed in Apache James version 3.6.2, released on 2022-02-07 [2][3]. All users are advised to upgrade to this version or later. No workarounds have been publicly documented. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.