CVE-2020-11998 Remote code execution in Apache ActiveMQ
A regression in JMX re-bind allows remote attackers to execute arbitrary code via MLet MBeans, requiring an upgrade to ActiveMQ.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-11998?
CVE-2020-11998 is a critical code injection vulnerability in Apache Activemq, published on 10 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
Which versions are affected by CVE-2020-11998?
3 open source packages ship an affected version, including org.apache.activemq:activemq-parent and activemq. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.activemq:activemq-parent Maven | From 5.15.12 | 5.15.13 |
org.apache.activemq:activemq-parent Maven | From 5.15.12 | 5.15.13 |
activemq Bitnami | From 5.15.12 to 5.15.12 | None |
Products include Apache Activemq, Oracle Communications Diameter Signaling Router, Oracle Communications Element Manager, Oracle Communications Session Report Manager, Oracle Communications Session Route Manager, Oracle Enterprise Repository and 1 more.
How do I fix CVE-2020-11998?
Upgrade org.apache.activemq:activemq-parent to 5.15.13 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-11998 being exploited?
There is no known exploitation of CVE-2020-11998 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Activemq
- CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data
- CVE-2016-3088 Apache ActiveMQ Improper Input Validation
- CVE-2026-34197 Apache ActiveMQ Improper Input Validation
- CVE-2013-7285 Command Injection in Xstream
- CVE-2014-3600 Improper Restriction of XML External Entity Reference in Apache ActiveMQ
Sources
Also known as BIT-activemq-2020-11998, GHSA-wqfh-9m4g-7x6x, UBUNTU-CVE-2020-11998.