Apache Jackrabbit Core and JCR Commons Deserialization Vulnerability Allowing JNDI Injection

A deserialization vulnerability allowing for the injection of malicious JNDI references has been identified in Apache Jackrabbit Core versions 1.0.0 prior to 2.22.1 and Apache Jackrabbit JCR Commons versions 1.0.0 prior to 2.22.1. This vulnerability arises in deployments that accept JNDI URIs for JCR lookup from untrusted users, potentially leading to arbitrary code execution through the deserialization of untrusted data.

Impact

Exploitation of this vulnerability could result in arbitrary code execution on the server where Apache Jackrabbit is deployed.

Remediation

Users are advised to upgrade to Apache Jackrabbit version 2.22.2, in which JCR lookup through JNDI has been disabled by default. Those who require this feature should enable it explicitly and review their use of JNDI URIs for JCR lookup.