Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
58Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.5epss 7.1%
from disclosure to weapon
Published on NVDMay 2
VulnCheck+720d
exploitation probability
7.1%top 6% of all CVEs
observed exploitation
yesVulnCheck
In short
Apache ActiveMQ's web APIs (Jolokia and Message REST API) are not protected by default, allowing anyone to access them without a password. This means attackers can control the message broker, send/receive messages, or delete data without permission.
Technical detail
The Jolokia JMX REST API and Message REST API in Apache ActiveMQ 6.x lack default authentication controls in the jetty.xml configuration. Remote unauthenticated attackers can invoke arbitrary JMX operations via Jolokia or manipulate message queues (produce, consume, purge, delete destinations) via the Message REST API, resulting in broker compromise and data loss.
Summary generated and translated by AI from the official description.
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).
It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).
To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:
<bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
<property name="constraint" ref="securityConstraint" />
<property name="pathSpec" value="/" />
</bean>
Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H
Affected products
Apache Software Foundation · Apache ActiveMQ