CVE-2022-41678 Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

What is CVE-2022-41678?

CVE-2022-41678 is a high-severity code injection vulnerability in Apache Activemq, published on 28 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. 

In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia

org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.

Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.

1 Call newRecording.

2 Call setConfiguration. And a webshell data hides in it.

3 Call startRecording.

4 Call copyTo method. The webshell will be written to a .jsp file.

The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

Weakness: CWE-287

Which versions are affected by CVE-2022-41678?

5 open source packages ship an affected version, including org.apache.activemq:apache-activemq and activemq. It affects 1 product.

Products include Apache Activemq.

How do I fix CVE-2022-41678?

Upgrade org.apache.activemq:apache-activemq to a fixed version for your release line: 5.16.6 or 5.17.4.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-41678 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41678 exists.

Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.

Other vulnerabilities in Apache Activemq

• CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data Exploited Critical 10.0
• CVE-2016-3088 Apache ActiveMQ Improper Input Validation Exploited Critical 9.8
• CVE-2026-34197 Apache ActiveMQ Improper Input Validation Exploited High 8.8
• CVE-2020-11998 Remote code execution in Apache ActiveMQ Critical 9.8
• CVE-2013-7285 Command Injection in Xstream Critical 9.8

All Apache Activemq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-activemq-2022-41678, DEBIAN-CVE-2022-41678, GHSA-53v4-42fg-g287, OESA-2023-1925, UBUNTU-CVE-2022-41678.