BIT-activemq-2022-41678

Import Source
https://github.com/bitnami/vulndb/tree/main/data/activemq/BIT-activemq-2022-41678.json
Aliases
Published
2024-01-31T15:12:06.066Z
Modified
2024-02-17T07:48:26.496Z
Details

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allowsorg.jolokia.http.AgentServlet to handler request to /api/jolokiaorg.jolokia.http.HttpRequestHandler#handlePostRequest is able tocreate JmxRequest through JSONObject. And calls toorg.jolokia.http.HttpRequestHandler#executeRequest.Into deeper calling stacks,org.jolokia.handler.ExecHandler#doHandleRequest is able to invokethrough refection.And then, RCE is able to be achieved viajdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.1 Call newRecording.2 Call setConfiguration. And a webshell data hides in it.3 Call startRecording.4 Call copyTo method. The webshell will be written to a .jsp file.The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

References

Affected packages

Bitnami / activemq

Package

Name
activemq

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
5.16.6
Introduced
5.17.0
Fixed
5.17.4