CVE-2022-41678

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt	Vendor Advisory
https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl	Mailing List Vendor Advisory
https://security.netapp.com/advisory/ntap-20240216-0004/
https://www.openwall.com/lists/oss-security/2023/11/28/1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:activemq::::::::
	cpe:2.3:a:apache:activemq::::::::

History

31 May 2024, 09:15

Type	Values Removed	Values Added
Summary	(en) Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection. And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.	(en) Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
References	~~{'url': 'http://www.openwall.com/lists/oss-security/2023/11/28/1', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'security@apache.org'}~~	() https://www.openwall.com/lists/oss-security/2023/11/28/1 -
CWE	~~CWE-502~~	CWE-287

16 Feb 2024, 13:15

Type	Values Removed	Values Added
References		() https://security.netapp.com/advisory/ntap-20240216-0004/ -

04 Dec 2023, 19:08

Type	Values Removed	Values Added
CPE		cpe:2.3:a:apache:activemq::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
References	~~() https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt -~~	() https://activemq.apache.org/security-advisories.data/CVE-2022-41678-announcement.txt - Vendor Advisory
References	~~() http://www.openwall.com/lists/oss-security/2023/11/28/1 -~~	() http://www.openwall.com/lists/oss-security/2023/11/28/1 - Mailing List, Third Party Advisory
References	~~() https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl -~~	() https://lists.apache.org/thread/7g17kwbtjl011mm4tr8bn1vnoq9wh4sl - Mailing List, Vendor Advisory
First Time		Apache activemq Apache

28 Nov 2023, 18:29

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2023/11/28/1 -

28 Nov 2023, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-28 16:15

Updated : 2024-05-31 09:15

NVD link : CVE-2022-41678

Mitre link : CVE-2022-41678

CVE.ORG link : CVE-2022-41678

JSON object : View

Products Affected

apache

activemq

CWE

CWE-287

Improper Authentication

8.8 /10