Apache ActiveMQ < 5.19.12 / 6.x < 6.3.3 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(376983);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/06");

  script_cve_id(
    "CVE-2026-108949",
    "CVE-2026-111821",
    "CVE-2026-111822"
  );

  script_name(english:"Apache ActiveMQ < 5.19.12 / 6.x < 6.3.3 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is running a web application that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apache ActiveMQ running on the remote host is prior to 5.19.12, or 6.x prior to 6.3.3. It is, therefore,
affected by multiple vulnerabilities:

  - Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config.
    After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated
    connection opened before the change can keep sending to that destination, including through a new anonymous
    producer, while fresh connections and new explicit producers are denied. (CVE-2026-111822)

  - Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that
    sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with
    InvalidDestinationException, but the rejected Subscription is left behind in the region's subscriptions map.
    Repeating the request leaks broker heap until OOM because the broker does not clean up the rejected subscriptions
    in the map. (CVE-2026-108949)

  - Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable
    subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being
    shorter) on a broker using KahaDB which can cause the broker to shutdown and be unrecoverable. (CVE-2026-111821)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/2l1jbc8j88w1n9bd44vm9bjtj9t3o80n");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/p8gxq66lmztkrls74wkz3xh9chqd0pwl");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/b5gop0kwsm4sr1pgdrfcd14q8hx942j5");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache ActiveMQ version 5.19.12, 6.3.3, 6.4.0, or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-111822");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/06");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:activemq");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("activemq_web_console_detect.nasl", "apache_activemq_nix_installed.nbin", "activemq_listen_port_detect.nbin");
  script_require_keys("installed_sw/Apache ActiveMQ");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Apache ActiveMQ', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '5.19.12'},
        {'min_version': '6.0.0', 'fixed_version': '6.3.3'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);