Vulnerability Analysis | Apache ActiveMQ Jolokia Remote Code Execution Vulnerability (CVE-2022-41678)

On November 28th, Apache released an advisory for the Apache ActiveMQ Jolokia Remote Code Execution Vulnerability (CVE-2022-41678). Once a user is authenticated on Jolokia, they can potentially trigger arbitrary code execution.

▌About Apache ActiveMQ

Apache ActiveMQ is an open-source message broker from the Apache Software Foundation that implements the Java Message Service (JMS) specification. As message-oriented middleware, it acts as a communication bridge between applications, allowing different applications to perform reliable asynchronous communication in a distributed environment.

After logging in and authenticating via the default port 8161, an attacker can send HTTP requests, modify the configuration file to write malicious files, and subsequently gain full control over the host. It is recommended that affected users perform self-checks and take protective measures.

▌Scope of Impact

• Apache ActiveMQ before 5.16.6

• Apache ActiveMQ 5.17.0 before 5.17.4

▌Vulnerability Replication

1. Target Environment Setup

• Download the open-source Apache ActiveMQ 5.17.3 environment:

  • https://github.com/apache/activemq/releases/tag/activemq-5.17.3

• Deploy using Tomcat.

Wait for the project to download dependencies, select JDK 11 or higher, and then perform the normal project deployment and execution.

Once startup is complete, access port 8161. If the above page appears, the deployment was successful.

You can also use docker-compose for quick deployment.

2. Vulnerability Analysis

• Analysing the source code, when initiating a request to this path /api/jolokia/list, some configuration information present in the current system will be obtained. The method used is setPredefinedConfiguration.

  • The request must include the 'Origin' request header, otherwise the request will fail.

• And the default configuration can be obtained here, in the default setting format.

• Modify the default code.

• Use POST to send the above XML.

• Then use GET to write the UA into the log.

• Finally, access the written file admin/shell.jsp.

• The command can be seen executed in the log and outputted to the log.

▌Code Execution Flow

Invocation Flow:

The main issue lies in the FlightRecorder MBean, whose functions include recording memory, GC, call stacks, etc. The methods used in this vulnerability are mainly as follows:

• newRecording

• setConfiguration

• startRecording

• stopRecording

• copyTo

The vulnerability concept involves using setConfiguration to modify the configuration, changing some key names to JSP code. The recorded data will then contain this JSP code. After the recording is complete, it can be exported to the web directory using copyTo.

▌SecurityValidation Verification Rules

On December 12th, the attack simulation for this vulnerability was added to the SecurityValidation Security Metrics Validation Platform. You can search for the keywords "ActiveMQ" or "CVE-2022-41678" in the SecurityValidation Security Metrics Validation Platform to obtain relevant attack simulation validation actions. This allows you to verify whether your security defence system can effectively handle this vulnerability. The platform ensures your validation process is safe and harmless using an industry-unique method.

▌Vulnerability Remediation

Add the following configuration to the default configuration of assembly/src/release/conf/jolokia-access.xml: