Patchfirst
Patchfirst
CVE-2022-41678 Public exploit EPSS 85.8%

Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

Apache Software Foundation · Apache ActiveMQ

Summary

Apache ActiveMQ's Jolokia management API (exposed at /api/jolokia) fails to restrict the operations authenticated users can invoke, allowing exploitation through the exec handler and its MBeans. An attacker who holds valid credentials for the Jolokia endpoint can achieve remote code execution, including by abusing an unrestricted deserialization path in the Flight Recorder MBean on Java versions above 11 to write a webshell to disk.

Official description · CVE.org

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

Breakdown
24.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 12 months after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+12 mo

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.activemq:apache-activemq.

Mavenorg.apache.activemq:apache-activemqGHSA-53v4-42fg-g287

Upgrade to 5.19.6 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2026-40466).

Set the version to 5.19.6 or later in your pom.xml or build.gradle.

First fixed in 5.17.4 for CVE-2022-41678.

Affected versions, by release line

If you runUpgrade to
5.17.0 up to 5.17.45.19.6first fix for this CVE: 5.17.4
All versions before 5.16.6

Still affected on this line by CVE-2026-40466 (fixed in 5.19.6, a newer line).

5.16.6

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

5 links, grouped by NVD tag

vendor-advisory 2

activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txtlists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl

Other 3

openwall.com/lists/oss-security/2023/11/28/1security.netapp.com/advisory/ntap-20240216-0004/lists.debian.org/debian-lts-announce/2024/10/msg00027.html
↑ ↓ chooseEnter openEsc close