Apache ActiveMQ up to 5.16.5/5.17.3 deserialization

Summaryinfo

A vulnerability was found in Apache ActiveMQ up to 5.16.5/5.17.3. It has been classified as critical. The affected element is an unknown function of the file /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest. This manipulation causes deserialization. This vulnerability is tracked as CVE-2022-41678. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Apache ActiveMQ up to 5.16.5/5.17.3 (Application Server Software) and classified as critical. Affected by this vulnerability is an unknown code block of the file /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection. And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

The weakness was disclosed 11/28/2023. It is possible to read the advisory at activemq.apache.org. This vulnerability is known as CVE-2022-41678 since 09/28/2022. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 209676 (Debian dla-3936 : activemq - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.16.6, 5.17.4, 5.18.0 or 6.0.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (209676). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• ActiveMQ

Version

• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.17.0
• 5.17.1
• 5.17.2
• 5.17.3

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion