CVE-2022-41678: Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE
Apache ActiveMQ could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the Jolokia component. By sending specially crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.
In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia
org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.
Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.
1 Call newRecording.
2 Call setConfiguration. And a webshell data hides in it.
3 Call startRecording.
4 Call copyTo method. The webshell will be written to a .jsp file.
The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
— MITRE
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.
In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia
org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.
Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection.
And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.
1 Call newRecording.
2 Call setConfiguration. And a webshell data hides in it.
3 Call startRecording.
4 Call copyTo method. The webshell will be written to a .jsp file.
The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-41678.
What is the title of this vulnerability?
The title of this vulnerability is Apache ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform…
What is the severity level of CVE-2022-41678?
The severity level of CVE-2022-41678 is not specified in the provided information.
How does the vulnerability in Apache ActiveMQ impact users?
The vulnerability in Apache ActiveMQ allows authenticated users to potentially trigger arbitrary code execution through Jolokia.
Which version of Apache ActiveMQ is affected by CVE-2022-41678?
CVE-2022-41678 affects Apache ActiveMQ versions 5.17.0 to 5.17.4 and 5.16.6.
How can I fix the vulnerability in Apache ActiveMQ?
To fix the vulnerability in Apache ActiveMQ, update to version 5.17.4 (for versions 5.17.0 to 5.17.4) or version 5.16.6 (for version 5.16.6).
Where can I find more information about CVE-2022-41678?
More information about CVE-2022-41678 can be found in the provided references: [Link 1](https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt), [Link 2](https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl), [Link 3](http://www.openwall.com/lists/oss-security/2023/11/28/1).