CVE-2023-50780: Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE.
Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.activemq:artemis-clito a version that resolves this vulnerability.Fixed in 2.29.0 - Compensating control
Restrict access to the Jolokia endpoint and exposed MBeans to administrative/trusted users only (for example: apply network-level restrictions such as firewall or reverse-proxy ACLs, or enforce Jolokia authentication/authorization) until systems are upgraded to 2.29.0 or later.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50780?
CVE-2023-50780 has been classified as a medium severity vulnerability due to the exposure of sensitive diagnostic information.
How do I fix CVE-2023-50780?
To mitigate CVE-2023-50780, upgrade Apache ActiveMQ Artemis to version 2.29.0 or later.
What systems are affected by CVE-2023-50780?
CVE-2023-50780 affects Apache ActiveMQ Artemis versions prior to 2.29.0.
What is the main issue with CVE-2023-50780?
The main issue with CVE-2023-50780 is the exposure of the Log4J2 MBean through the Jolokia endpoint, which should not be accessible to non-administrative users.
Is user access to MBeans restricted in CVE-2023-50780?
No, in versions prior to 2.29.0, user access to MBeans was not adequately restricted, allowing unauthorized access to diagnostic controls.