Apache UIMA DUCC: DUCC (EOL) allows RCE

Vulnerability

Overview CVE-2023-28935 is a command injection vulnerability in the Apache UIMA DUCC (Distributed UIMA Cluster Computing) module. The root cause is improper neutralization of special elements used in a command, allowing an authenticated user to inject arbitrary commands [1].

Exploitation

An attacker must be authenticated and have permissions to modify core entities within the DUCC web application. The attack surface is the web process, and the attacker can trigger command execution without requiring direct access to the underlying system [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands as the system user that runs the web process. This can lead to full system compromise, including unauthorized access, data exfiltration, and further lateral movement [1].

Mitigation

The Apache UIMA DUCC project was retired on December 21, 2022, and is no longer maintained. No patches will be released. Users are strongly advised to migrate to supported alternatives. The source code remains available for archival reference [2].