CVE-2022-41678
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.
Technology
Apache ActiveMQ
CVSS Score
8.8 / 10.0
Affected Versions
<5.16.6; >=5.17.0 <5.17.4
Upstream Fix
See upstream advisory
Published
November 28, 2023
OSSeva Coverage
Fixed upstream
Description
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on J
Is your Apache ActiveMQ deployment affected?
If you're running <5.16.6; >=5.17.0 <5.17.4, you need this patch. Book a discovery call to get covered.