PT-2023-14012 · Oracle+4 · Java+5

Honglonglong + 5 · Published 2023-11-28 · Updated 2026-06-10 · CVE-2022-41678

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.16.6 Apache ActiveMQ versions prior to 5.17.4 Apache ActiveMQ versions prior to 5.18.0 Apache ActiveMQ versions prior to 6.0.0

Description An authentication flaw in the Jolokia component allows an authenticated user to trigger arbitrary code execution. In ActiveMQ configurations, the Jetty server allows org.jolokia.http.AgentServlet to handle requests to the '/api/jolokia' endpoint. The handlePostRequest() function in org.jolokia.http.HttpRequestHandler can create a JmxRequest via JSONObject and call executeRequest(). Further in the call stack, doHandleRequest() in org.jolokia.handler.ExecHandler can be invoked through reflection. This can lead to remote code execution via various MBeans, such as unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl on Java versions above 11. The exploitation process involves calling newRecording(), setConfiguration() to hide webshell data, startRecording(), and the copyTo method to write the webshell to a .jsp file.

Recommendations Update to Apache ActiveMQ versions 5.16.6, 5.17.4, 5.18.0, or 6.0.0 to apply a more restrictive Jolokia configuration. Disable Jolokia or restrict the authorized actions within Jolokia to minimize the risk of exploitation.

Exploit

Fix

RCE

Improper Authentication

Deserialization of Untrusted Data

Weakness Enumeration

CWE-287

CWE-502

Related Identifiers

BDU:2026-05819

BIT-ACTIVEMQ-2022-41678

CVE-2022-41678

DLA-3936-1

DSA-5798-1

GHSA-53V4-42FG-G287

OESA-2023-1925

USN-6910-1

USN-7268-1

Affected Products

Activemq

Jdk

Java

Jetty

Linuxmint

Ubuntu

References · 55

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb · Exploit
• 🔥 https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ · Exploit
• 🔥 https://github.com/evkl1d/CVE-2023-46604 · Exploit
• 🔥 https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit · Exploit
• 🔥 https://github.com/sule01u/CVE-2023-46604 · Exploit
• 🔥 https://github.com/duck-sec/CVE-2023-46604-ActiveMQ-RCE-pseudoshell · Exploit
• 🔥 https://github.com/justdoit-cai/CVE-2023-46604-Apache-ActiveMQ-RCE-exp · Exploit
• 🔥 https://github.com/h3x3h0g/ActiveMQ-RCE-CVE-2023-46604-Write-up · Exploit
• https://osv.dev/vulnerability/DLA-3936-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-41678 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7268-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7559 · Vendor Advisory
• https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7268-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05819 · Security Note