CVE-2024-32114 Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

What is CVE-2024-32114?

CVE-2024-32114 is a high-severity missing authorization vulnerability in Apache Activemq, published on 2 May 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).

To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">   <property name="constraint" ref="securityConstraint" />   <property name="pathSpec" value="/" /> </bean>

Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.

Weakness: CWE-1188

Which versions are affected by CVE-2024-32114?

3 open source packages ship an affected version, including org.apache.activemq:apache-activemq and activemq. It affects 1 product.

Products include Apache Activemq.

How do I fix CVE-2024-32114?

Upgrade org.apache.activemq:apache-activemq to 6.1.2 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-32114 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32114 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in Apache Activemq

• CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data Exploited Critical 10.0
• CVE-2016-3088 Apache ActiveMQ Improper Input Validation Exploited Critical 9.8
• CVE-2026-34197 Apache ActiveMQ Improper Input Validation Exploited High 8.8
• CVE-2020-11998 Remote code execution in Apache ActiveMQ Critical 9.8
• CVE-2013-7285 Command Injection in Xstream Critical 9.8

All Apache Activemq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-activemq-2024-32114, GHSA-gj5m-m88j-v7c3.