REDHAT-BUG-2455869: Input Validation
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .
Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQ Brokerto a version that resolves this vulnerability.Fixed in 5.19.5 - Upgrade
Upgrade
Apache ActiveMQ Brokerto a version that resolves this vulnerability.Fixed in 6.2.3 - Configuration
Modify the Jolokia access policy so that exec operations are not permitted for org.apache.activemq:* (the default policy permits exec on all ActiveMQ MBeans).
Apache ActiveMQ Jolokia JMX-HTTP bridge Jolokia access policy (exec operations) for MBeans org.apache.activemq:* = deny exec operations on org.apache.activemq:* (or restrict to only required MBeans/operations)
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2455869?
The severity of REDHAT-BUG-2455869 is categorized as high with a score of 7.
What type of vulnerability is REDHAT-BUG-2455869?
REDHAT-BUG-2455869 is identified as an improper input validation vulnerability leading to potential code injection.
What software is affected by REDHAT-BUG-2455869?
REDHAT-BUG-2455869 affects Apache ActiveMQ Broker and Apache ActiveMQ.
How do I fix REDHAT-BUG-2455869?
To fix REDHAT-BUG-2455869, it is recommended to update Apache ActiveMQ to the latest patched version that addresses the vulnerability.
What is the impact of REDHAT-BUG-2455869?
The impact of REDHAT-BUG-2455869 can lead to unauthorized code execution through the Jolokia JMX-HTTP bridge.