CVE-2022-41678 Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

2023-11-2815:08:38

CWE-287

apache

www.cve.org

apache activemq

api restrictions

jolokia

rce

jetty

jmxrequest

reflection

deserialization

webshell

mitigation

activemq distribution

upgrade

8.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.4%

JSON

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.

In details, in ActiveMQ configurations, jetty allows
org.jolokia.http.AgentServlet to handler request to /api/jolokia

org.jolokia.http.HttpRequestHandler#handlePostRequest is able to
create JmxRequest through JSONObject. And calls to
org.jolokia.http.HttpRequestHandler#executeRequest.

Into deeper calling stacks,
org.jolokia.handler.ExecHandler#doHandleRequest can be invoked
through refection. This could lead to RCE through via
various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.

1 Call newRecording.

2 Call setConfiguration. And a webshell data hides in it.

3 Call startRecording.

4 Call copyTo method. The webshell will be written to a .jsp file.

The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.
A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.activemq:apache-activemq",
    "product": "Apache ActiveMQ",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "5.16.6",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.17.4",
        "status": "affected",
        "version": "5.17.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.18.0"
      },
      {
        "status": "unaffected",
        "version": "6.0.0"
      }
    ]
  }
]