PT-2026-30805 · Apache+1 · Apache Activemq+1
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache ActiveMQ Broker versions prior to 5.19.7
Apache ActiveMQ Broker versions 6.0.0 through 6.2.5
Apache ActiveMQ All versions prior to 5.19.7
Apache ActiveMQ All versions 6.0.0 through 6.2.5
Apache ActiveMQ versions prior to 5.19.7
Apache ActiveMQ versions 6.0.0 through 6.2.5
Description
An authenticated attacker can achieve remote code execution on the broker's Java Virtual Machine (JVM) by exploiting improper input validation and improper control of code generation. The issue exists because the Jolokia JMX-HTTP bridge, exposed at the '/api/jolokia/' endpoint, allows execution operations on ActiveMQ MBeans, specifically through the
addNetworkConnector(String) and addConnector(String) functions of the BrokerService. By sending a specially crafted discovery URI, an attacker can trigger the brokerConfig parameter of the VM transport to load a remote Spring XML application context using ResourceXmlApplicationContext. Since this context instantiates singleton beans before configuration validation occurs, arbitrary code can be executed via bean factory methods such as Runtime.exec(). Real-world exploitation of this issue has been documented.Recommendations
Upgrade Apache ActiveMQ Broker to version 5.19.7 or 6.2.6.
Upgrade Apache ActiveMQ All to version 5.19.7 or 6.2.6.
Upgrade Apache ActiveMQ to version 5.19.7 or 6.2.6.
Restrict or disable Jolokia execution operations and enforce strong authentication policies.
Block or limit network access to the '/api/jolokia/' endpoint and the web console to trusted management networks.
Restrict the use of the
addNetworkConnector(String) and addConnector(String) functions within the BrokerService until the system is updated.Exploit
Fix
DoS
RCE
LPE
Code Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Activemq
Red Os