Apache ActiveMQ < 5.19.7 / 6.x < 6.2.6 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(318667);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/04");

  script_cve_id(
    "CVE-2026-45505",
    "CVE-2026-46605",
    "CVE-2026-49157"
  );

  script_name(english:"Apache ActiveMQ < 5.19.7 / 6.x < 6.2.6 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is running a web application that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apache ActiveMQ running on the remote host is prior to 5.19.7 or 6.x prior to 6.2.6. It is, therefore,
affected by multiple vulnerabilities:

  - Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache
    ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as
    masterslave:vm://...,... and static:vm://... incorrectly pass validation allowing bypass of fix in
    CVE-2026-34197. An authenticated attacker can invoke these operations with a crafted discovery URI that triggers
    the VM transport's brokerConfig parameter to load a remote Spring XML application context using
    ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans
    before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through
    bean factory methods such as Runtime.exec(). (CVE-2026-45505)

  - Incomplete authorization by Apache ActiveMQ server allows authenticated connections to remove existing
    destinations with proper permissions. (CVE-2026-46605)

  - Incorrect Default Permissions vulnerability in Apache ActiveMQ. The default Jolokia authorization settings
    granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker
    management operations meant for admins such as addQueue and removeQueue. (CVE-2026-49157)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://activemq.apache.org/security-advisories.data/CVE-2026-45505-announcement.txt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a28095d0");
  # https://activemq.apache.org/security-advisories.data/CVE-2026-46605-announcement.txt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2908cc8c");
  # https://activemq.apache.org/security-advisories.data/CVE-2026-49157-announcement.txt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a61553df");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache ActiveMQ version 5.19.7, 6.2.6, or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-45505");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/04");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:activemq");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("activemq_web_console_detect.nasl", "apache_activemq_nix_installed.nbin", "activemq_listen_port_detect.nbin");
  script_require_keys("installed_sw/Apache ActiveMQ");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Apache ActiveMQ', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '5.19.7'},
        {'min_version':'6.0.0', 'fixed_version': '6.2.6'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);