STARTTLS command injection in Apache JAMES

Apache James versions prior to 3.6.3 and 3.7.1 are vulnerable to a buffering attack exploiting the STARTTLS command [1]. The root cause is a parser differential in the fix for CVE-2021-38542, which does not account for concurrent requests, allowing an attacker to inject commands during the TLS handshake [1][2].

An attacker can perform a man-in-the-middle attack to inject STARTTLS commands. Exploitation requires no authentication for SMTP, but a local account is needed for IMAP; POP3 data integrity may also be compromised [2]. The attack can lead to leakage of sensitive information such as user credentials [2].

Successful exploitation can result in credential disclosure and potential data integrity issues across protocols [2]. The vulnerability is tracked as JAMES-1862 [2].

Mitigation involves upgrading to Apache James 3.7.1 or 3.6.3, which include the fix [2][4]. No workarounds have been provided [2].