CVE-2023-39913: Apache UIMA Java SDK RCE Vulnerability

CVE-2023-39913 Overview

CVE-2023-39913 is an insecure deserialization vulnerability affecting Apache UIMA Java SDK versions prior to 3.5.0. The vulnerability stems from improper input validation when handling serialized Java objects across multiple components of the framework. This flaw allows attackers with network access to potentially achieve remote code execution by submitting maliciously crafted serialized data to vulnerable UIMA services or applications.

Critical Impact

Unrestricted deserialization of Java-serialized CAS files may allow arbitrary remote code execution when using vulnerable UIMA services or applications that process untrusted serialized data.

Affected Products

• Apache UIMA Java SDK versions prior to 3.5.0
• Applications using CasIOUtils class to parse serialized CAS data
• UIMA-based services accepting Java-serialized CAS objects over network connections

Discovery Timeline

• November 8, 2023 - CVE-2023-39913 published to NVD
• February 13, 2025 - Last updated in NVD database

Technical Details for CVE-2023-39913

Vulnerability Analysis

This vulnerability represents a classic Java deserialization attack surface where serialized Java objects are processed without proper validation. The Apache UIMA framework contains multiple code paths that deserialize untrusted data, creating opportunities for attackers to inject malicious serialized objects. When these objects are deserialized, they can trigger arbitrary code execution through gadget chains present in the application's classpath.

The vulnerability is particularly concerning because it affects several core components within the UIMA ecosystem, including the CasIOUtils class which is commonly used by developers building UIMA-based applications. While the framework itself does not start remotely accessible services by default, any application or service that uses the affected components to process external data becomes vulnerable.

Root Cause

The root cause is the absence of proper deserialization filters (ObjectInputFilter) when reading Java-serialized data in multiple UIMA components. The affected code paths include:

• Deserialization of Java-serialized CAS and binary CAS formats containing TSI information via CasIOUtils
• The CAS Editor Eclipse plugin data loading functionality
• The Vinci Analysis Engine service network communication
• The CasAnnotationViewerApplet and CasTreeViewerApplet components
• The checkpointing feature of the CPE module

Without proper filtering, any serializable class available on the classpath can be instantiated during deserialization, enabling attackers to leverage known deserialization gadget chains for code execution.

Attack Vector

The attack requires network access and low privileges to exploit. An attacker can craft a malicious serialized Java object containing a gadget chain and submit it to any vulnerable endpoint that processes UIMA serialized data. The Vinci Analysis Engine service, if enabled, can receive Java-serialized CAS objects over network connections, making it a direct attack vector. Additionally, any custom application using CasIOUtils to parse untrusted serialized CAS data is susceptible to this attack.

The attack does not require user interaction and can be executed remotely against exposed services. Upon successful exploitation, the attacker gains code execution with the privileges of the UIMA service or application process.

Detection Methods for CVE-2023-39913

Indicators of Compromise

• Unexpected network connections from UIMA-based applications to unknown external hosts
• Unusual process spawning or command execution originating from Java processes running UIMA
• Anomalous serialized object payloads in network traffic targeting UIMA services
• Log entries indicating deserialization errors or unexpected class loading attempts

Detection Strategies

• Monitor network traffic for suspicious serialized Java object patterns being sent to UIMA service endpoints
• Implement application-level logging to capture deserialization events and flag unexpected class instantiation
• Deploy runtime application self-protection (RASP) solutions capable of detecting deserialization attacks
• Use SentinelOne's behavioral AI to detect post-exploitation activities such as unexpected process creation or network callbacks

Monitoring Recommendations

• Enable verbose logging for UIMA applications to capture incoming serialized data processing events
• Implement network segmentation to isolate UIMA services from untrusted networks
• Configure alerts for any Vinci Analysis Engine service network activity if such services are deployed
• Monitor for the presence of common Java deserialization gadget chain classes in application logs

How to Mitigate CVE-2023-39913

Immediate Actions Required

• Upgrade Apache UIMA Java SDK to version 3.5.0 or later immediately
• Audit all applications using CasIOUtils to identify potential exposure to untrusted serialized data
• Disable or restrict network access to Vinci Analysis Engine services if they are not required
• Upgrade from Java 1.8 to Java 9 or later if running affected UIMA versions that cannot be immediately upgraded

Patch Information

Apache has released UIMA Java SDK version 3.5.0 which addresses this vulnerability by implementing tightly scoped ObjectInputFilters when reading Java-serialized data. The fix automatically applies appropriate deserialization restrictions based on the expected data type, eliminating the need for manual filter configuration. Users should upgrade to version 3.5.0 or later to fully remediate this issue. For more details, see the Apache Security Thread and OpenWall OSS Security Discussion.

Workarounds

• Configure a JVM-wide ObjectInputFilter using the jdk.serialFilter system property (Java 9+ required)
• Restrict allowed classes to only necessary UIMA serialization classes and terminate with !* to deny all others
• Isolate UIMA services behind network controls that prevent untrusted input from reaching vulnerable endpoints
• Implement input validation at the application layer to reject unexpected serialized data formats before processing

# Configuration example for Java 9+ ObjectInputFilter
# Add to JVM startup arguments to restrict deserialization classes

java -Djdk.serialFilter="org.apache.uima.cas.impl.CASCompleteSerializer;org.apache.uima.cas.impl.CASMgrSerializer;org.apache.uima.cas.impl.CASSerializer;java.lang.String;org.apache.uima.collection.impl.cpm.CheckpointData;org.apache.uima.util.ProcessTrace;org.apache.uima.util.impl.ProcessTrace_impl;org.apache.uima.collection.base_cpm.SynchPoint;!*" -jar your-uima-application.jar